feat(ci): implement comprehensive CI/CD workflows and quality gates

Phase 1: Core GitHub Workflows Implementation Composite Actions (4): - setup-python-deps: Cache Python dependencies for faster runs - fork-safety: Detect fork PRs and prevent malicious write operations - rate-limit-check: Circuit breaker pattern for GitHub API exhaustion - quality-gates: Python syntax, Markdown lint, Bash validation, secret scanning Workflows (5): - bootstrap.yml: One-time repository setup (labels, milestones, settings) - reusable-pr-checks.yml: DRY quality gate orchestrator - pr-into-dev.yml: Feature PR validation (branch names, conventional commits, linked issues) - dev-to-main.yml: Release gate validation (source branch, CHANGELOG, production readiness) - release.yml: Manual release creation with GitHub releases and auto-generated notes Branch Strategy: Standard (feature/* → dev → main) Quality Gates: Python, Markdown, Bash, Secrets Release Trigger: Manual via /release command or workflow_dispatch Implements comprehensive CI/CD system adapted from blueprint: - Fork safety and rate limiting for security - Conventional commits enforcement - Automated quality validation - Production release gates - GitHub release automation Next: Phase 2 (templates, CODEOWNERS, dependabot)
2026-07-03 10:23:15 -04:00 · 2025-11-12 12:51:48 +01:00
parent eea0f09753
commit dd6a6c24d7
9 changed files with 1661 additions and 0 deletions
@@ -0,0 +1,190 @@
+name: 'Bootstrap Repository'
+
+on:
+  workflow_dispatch:
+    inputs:
+      create-labels:
+        description: 'Create standard labels'
+        required: false
+        default: 'true'
+        type: boolean
+      create-milestones:
+        description: 'Create initial milestones'
+        required: false
+        default: 'true'
+        type: boolean
+      validate-settings:
+        description: 'Validate repository settings'
+        required: false
+        default: 'true'
+        type: boolean
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  bootstrap:
+    name: Setup Repository
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Rate limit check
+        uses: ./.github/actions/rate-limit-check
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          minimum-remaining: 100
+
+      - name: Create standard labels
+        if: inputs.create-labels == true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "::group::Creating Labels"
+
+          # Type labels
+          gh label create "bug" --description "Something isn't working" --color "d73a4a" --force
+          gh label create "enhancement" --description "New feature or request" --color "a2eeef" --force
+          gh label create "documentation" --description "Improvements or additions to documentation" --color "0075ca" --force
+          gh label create "refactor" --description "Code refactoring" --color "fbca04" --force
+          gh label create "performance" --description "Performance improvements" --color "00ff00" --force
+          gh label create "security" --description "Security issues or improvements" --color "ee0701" --force
+          gh label create "test" --description "Testing related" --color "1d76db" --force
+
+          # Priority labels
+          gh label create "priority: critical" --description "Critical priority" --color "b60205" --force
+          gh label create "priority: high" --description "High priority" --color "d93f0b" --force
+          gh label create "priority: medium" --description "Medium priority" --color "fbca04" --force
+          gh label create "priority: low" --description "Low priority" --color "0e8a16" --force
+
+          # Status labels
+          gh label create "status: blocked" --description "Blocked by another issue" --color "d93f0b" --force
+          gh label create "status: in progress" --description "Work in progress" --color "0052cc" --force
+          gh label create "status: review needed" --description "Needs review" --color "fbca04" --force
+          gh label create "status: needs discussion" --description "Needs team discussion" --color "d876e3" --force
+
+          # Component labels
+          gh label create "component: installer" --description "Installation scripts" --color "5319e7" --force
+          gh label create "component: skill" --description "Python skill modules" --color "5319e7" --force
+          gh label create "component: command" --description "Slash commands" --color "5319e7" --force
+          gh label create "component: agent" --description "Guardian agent" --color "5319e7" --force
+          gh label create "component: docs" --description "Documentation" --color "5319e7" --force
+          gh label create "component: ci/cd" --description "CI/CD workflows" --color "5319e7" --force
+
+          # Additional labels
+          gh label create "good first issue" --description "Good for newcomers" --color "7057ff" --force
+          gh label create "help wanted" --description "Extra attention is needed" --color "008672" --force
+          gh label create "dependencies" --description "Dependency updates" --color "0366d6" --force
+          gh label create "breaking change" --description "Breaking change" --color "ee0701" --force
+
+          echo "✅ Labels created successfully"
+          echo "::endgroup::"
+
+      - name: Create milestones
+        if: inputs.create-milestones == true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "::group::Creating Milestones"
+
+          # Get current date for due dates
+          CURRENT_DATE=$(date -u +%Y-%m-%d)
+
+          # Calculate due dates (approximate)
+          V1_1_DUE=$(date -u -d "+1 month" +%Y-%m-%dT23:59:59Z 2>/dev/null || date -u -v+1m +%Y-%m-%dT23:59:59Z)
+          V1_2_DUE=$(date -u -d "+2 months" +%Y-%m-%dT23:59:59Z 2>/dev/null || date -u -v+2m +%Y-%m-%dT23:59:59Z)
+          V2_0_DUE=$(date -u -d "+4 months" +%Y-%m-%dT23:59:59Z 2>/dev/null || date -u -v+4m +%Y-%m-%dT23:59:59Z)
+
+          # Create milestones (using gh api since gh doesn't have milestone create command)
+          gh api repos/${{ github.repository }}/milestones \
+            --method POST \
+            --field title="v1.1.0" \
+            --field description="Additional templates, enhanced detection, granular quality scoring" \
+            --field due_on="$V1_1_DUE" || echo "Milestone v1.1.0 may already exist"
+
+          gh api repos/${{ github.repository }}/milestones \
+            --method POST \
+            --field title="v1.2.0" \
+            --field description="VS Code extension, GitHub Actions enhancements, advanced quality hooks" \
+            --field due_on="$V1_2_DUE" || echo "Milestone v1.2.0 may already exist"
+
+          gh api repos/${{ github.repository }}/milestones \
+            --method POST \
+            --field title="v2.0.0" \
+            --field description="AI-powered suggestions, multi-language support, web dashboard, plugin system" \
+            --field due_on="$V2_0_DUE" || echo "Milestone v2.0.0 may already exist"
+
+          echo "✅ Milestones created successfully"
+          echo "::endgroup::"
+
+      - name: Validate repository settings
+        if: inputs.validate-settings == true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "::group::Validating Settings"
+
+          # Get repository info
+          REPO_INFO=$(gh api repos/${{ github.repository }})
+
+          # Check important settings
+          HAS_ISSUES=$(echo "$REPO_INFO" | jq -r '.has_issues')
+          HAS_WIKI=$(echo "$REPO_INFO" | jq -r '.has_wiki')
+          HAS_DISCUSSIONS=$(echo "$REPO_INFO" | jq -r '.has_discussions')
+
+          echo "📊 Repository Settings:"
+          echo "   - Issues: $HAS_ISSUES"
+          echo "   - Wiki: $HAS_WIKI"
+          echo "   - Discussions: $HAS_DISCUSSIONS"
+          echo ""
+
+          if [ "$HAS_ISSUES" != "true" ]; then
+            echo "::warning::Issues are not enabled. Consider enabling them in Settings > General > Features."
+          fi
+
+          if [ "$HAS_DISCUSSIONS" != "true" ]; then
+            echo "::notice::Discussions are not enabled. Consider enabling them for community Q&A."
+          fi
+
+          # Check if default branch is 'main'
+          DEFAULT_BRANCH=$(echo "$REPO_INFO" | jq -r '.default_branch')
+          echo "   - Default Branch: $DEFAULT_BRANCH"
+
+          if [ "$DEFAULT_BRANCH" != "main" ] && [ "$DEFAULT_BRANCH" != "dev" ]; then
+            echo "::warning::Default branch is '$DEFAULT_BRANCH'. Consider using 'main' or 'dev'."
+          fi
+
+          echo "::endgroup::"
+
+      - name: Bootstrap summary
+        run: |
+          echo "## 🎉 Repository Bootstrap Complete!" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Actions Performed" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ inputs.create-labels }}" == "true" ]]; then
+            echo "- ✅ Created 23 standard labels" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [[ "${{ inputs.create-milestones }}" == "true" ]]; then
+            echo "- ✅ Created 3 milestones (v1.1.0, v1.2.0, v2.0.0)" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [[ "${{ inputs.validate-settings }}" == "true" ]]; then
+            echo "- ✅ Validated repository settings" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "1. Create \`dev\` branch from \`main\`" >> $GITHUB_STEP_SUMMARY
+          echo "2. Configure branch protection rules" >> $GITHUB_STEP_SUMMARY
+          echo "3. Set \`dev\` as default branch for PRs" >> $GITHUB_STEP_SUMMARY
+          echo "4. Review and adjust labels/milestones as needed" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "🔗 See [GITHUB_WORKFLOWS.md](docs/GITHUB_WORKFLOWS.md) for complete setup guide" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,322 @@
+name: 'PR Dev to Main (Release Gate)'
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  validate-release-pr:
+    name: Validate Release PR
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history for changelog validation
+
+      - name: Fork safety check
+        id: fork-check
+        uses: ./.github/actions/fork-safety
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Validate source branch
+        id: validate-branch
+        run: |
+          SOURCE_BRANCH="${{ github.head_ref }}"
+          echo "Source branch: $SOURCE_BRANCH"
+
+          # Only allow specific branches to merge to main
+          ALLOWED_PATTERNS="^(dev|release/.*|dependabot/.*)$"
+
+          if [[ "$SOURCE_BRANCH" =~ $ALLOWED_PATTERNS ]]; then
+            echo "✅ Source branch is allowed to merge to main"
+            echo "valid=true" >> $GITHUB_OUTPUT
+          else
+            echo "::error::Only 'dev', 'release/*', or 'dependabot/*' branches can merge to main"
+            echo "::error::Current branch: $SOURCE_BRANCH"
+            echo "::error::Please merge to 'dev' first, then create a PR from 'dev' to 'main'"
+            echo "valid=false" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+      - name: Check CHANGELOG.md updated
+        id: check-changelog
+        run: |
+          echo "Checking if CHANGELOG.md was updated..."
+
+          # Check if CHANGELOG.md exists
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "::warning::CHANGELOG.md not found"
+            echo "updated=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          # Check if CHANGELOG.md was modified in this PR
+          CHANGED_FILES=$(git diff --name-only origin/main...HEAD)
+
+          if echo "$CHANGED_FILES" | grep -q "CHANGELOG.md"; then
+            echo "✅ CHANGELOG.md was updated"
+            echo "updated=true" >> $GITHUB_OUTPUT
+          else
+            echo "::warning::CHANGELOG.md was not updated in this PR"
+            echo "::warning::Consider adding release notes to CHANGELOG.md"
+            echo "updated=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate version consistency
+        id: check-version
+        run: |
+          echo "Checking version consistency across files..."
+
+          # Extract version from CHANGELOG.md if it exists
+          if [ -f "CHANGELOG.md" ]; then
+            CHANGELOG_VERSION=$(grep -m 1 "^## \[" CHANGELOG.md | sed -n 's/.*\[\(.*\)\].*/\1/p' || echo "unknown")
+            echo "CHANGELOG.md version: $CHANGELOG_VERSION"
+          else
+            CHANGELOG_VERSION="unknown"
+          fi
+
+          # Extract version from install scripts if they contain version info
+          if grep -q "v1\." install.sh 2>/dev/null; then
+            INSTALLER_VERSION=$(grep -o "v[0-9]\+\.[0-9]\+\.[0-9]\+" install.sh | head -1 || echo "unknown")
+            echo "Installer version: $INSTALLER_VERSION"
+
+            if [ "$CHANGELOG_VERSION" != "unknown" ] && [ "$INSTALLER_VERSION" != "unknown" ]; then
+              if [ "v$CHANGELOG_VERSION" != "$INSTALLER_VERSION" ] && [ "$CHANGELOG_VERSION" != "$INSTALLER_VERSION" ]; then
+                echo "::warning::Version mismatch between CHANGELOG.md ($CHANGELOG_VERSION) and installer ($INSTALLER_VERSION)"
+              else
+                echo "✅ Version consistency validated"
+              fi
+            fi
+          fi
+
+          echo "consistent=true" >> $GITHUB_OUTPUT
+
+      - name: Production readiness checklist
+        run: |
+          echo "## 🚀 Production Readiness Checklist" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
+
+          # Source branch check
+          if [[ "${{ steps.validate-branch.outputs.valid }}" == "true" ]]; then
+            echo "| Source Branch | ✅ Valid |" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "| Source Branch | ❌ Invalid |" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          # CHANGELOG check
+          if [[ "${{ steps.check-changelog.outputs.updated }}" == "true" ]]; then
+            echo "| CHANGELOG.md | ✅ Updated |" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "| CHANGELOG.md | ⚠️ Not Updated |" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          # Version check
+          if [[ "${{ steps.check-version.outputs.consistent }}" == "true" ]]; then
+            echo "| Version Consistency | ✅ Consistent |" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "| Version Consistency | ⚠️ Check Needed |" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: Comment on branch validation failure
+        if: failure() && steps.validate-branch.outputs.valid != 'true' && steps.fork-check.outputs.should-skip-writes != 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const comment = `## ❌ Invalid Source Branch for Main
+
+            Only the following branches can merge to \`main\`:
+            - \`dev\` (standard release flow)
+            - \`release/*\` (release branches)
+            - \`dependabot/*\` (dependency updates)
+
+            **Current branch**: \`${{ github.head_ref }}\`
+
+            ### How to Fix
+
+            If this is a feature or fix branch:
+            1. Close this PR
+            2. Create a PR to \`dev\` instead
+            3. After merging to \`dev\`, create a PR from \`dev\` to \`main\`
+
+            If this is an emergency hotfix:
+            1. Create a \`release/x.x.x-hotfix\` branch
+            2. Make your changes there
+            3. Create PR from release branch to \`main\`
+
+            📚 See [BRANCHING_STRATEGY.md](../blob/main/docs/BRANCHING_STRATEGY.md) for details.`;
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: comment
+            });
+
+  quality-checks:
+    name: Run Quality Checks
+    needs: validate-release-pr
+    uses: ./.github/workflows/reusable-pr-checks.yml
+    with:
+      python-version: '3.11'
+      skip-python: false
+      skip-markdown: false
+      skip-bash: false
+      skip-secrets: false
+
+  production-build:
+    name: Validate Production Build
+    needs: [validate-release-pr, quality-checks]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Validate installation scripts
+        run: |
+          echo "::group::Installation Script Validation"
+
+          # Check install.sh
+          if [ -f "install.sh" ]; then
+            echo "✅ install.sh exists"
+
+            # Check if executable
+            if [ -x "install.sh" ]; then
+              echo "✅ install.sh is executable"
+            else
+              echo "::warning::install.sh is not executable (chmod +x needed)"
+            fi
+
+            # Validate syntax
+            if bash -n install.sh; then
+              echo "✅ install.sh syntax valid"
+            else
+              echo "::error::install.sh has syntax errors"
+              exit 1
+            fi
+          else
+            echo "::error::install.sh not found"
+            exit 1
+          fi
+
+          # Check install.ps1
+          if [ -f "install.ps1" ]; then
+            echo "✅ install.ps1 exists"
+          else
+            echo "::warning::install.ps1 not found"
+          fi
+
+          echo "::endgroup::"
+
+      - name: Validate skill modules structure
+        run: |
+          echo "::group::Skill Modules Validation"
+
+          REQUIRED_FILES=(
+            "skill/analyzer.py"
+            "skill/validator.py"
+            "skill/generator.py"
+            "skill/template_selector.py"
+            "skill/workflow.py"
+          )
+
+          ALL_EXIST=true
+          for file in "${REQUIRED_FILES[@]}"; do
+            if [ -f "$file" ]; then
+              echo "✅ $file exists"
+            else
+              echo "::error::$file not found"
+              ALL_EXIST=false
+            fi
+          done
+
+          if [ "$ALL_EXIST" = false ]; then
+            exit 1
+          fi
+
+          echo "::endgroup::"
+
+      - name: Validate documentation
+        run: |
+          echo "::group::Documentation Validation"
+
+          REQUIRED_DOCS=(
+            "README.md"
+            "CHANGELOG.md"
+            "LICENSE"
+            "docs/INSTALLATION.md"
+            "docs/QUICK_START.md"
+          )
+
+          ALL_EXIST=true
+          for doc in "${REQUIRED_DOCS[@]}"; do
+            if [ -f "$doc" ]; then
+              echo "✅ $doc exists"
+            else
+              echo "::warning::$doc not found"
+            fi
+          done
+
+          echo "::endgroup::"
+
+  release-summary:
+    name: Release Summary
+    needs: [validate-release-pr, quality-checks, production-build]
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Generate summary
+        run: |
+          echo "## 🚀 Release Gate Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Validation Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ needs.validate-release-pr.result }}" == "success" ]]; then
+            echo "- ✅ Release PR validated" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- ❌ Release PR validation failed" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [[ "${{ needs.quality-checks.result }}" == "success" ]]; then
+            echo "- ✅ Quality checks passed" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- ❌ Quality checks failed" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [[ "${{ needs.production-build.result }}" == "success" ]]; then
+            echo "- ✅ Production build validated" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- ❌ Production build validation failed" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ needs.validate-release-pr.result }}" == "success" ]] && \
+             [[ "${{ needs.quality-checks.result }}" == "success" ]] && \
+             [[ "${{ needs.production-build.result }}" == "success" ]]; then
+            echo "### ✅ All release gates passed! Ready for production." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "After merging, consider:" >> $GITHUB_STEP_SUMMARY
+            echo "1. Creating a GitHub release with `/release` command" >> $GITHUB_STEP_SUMMARY
+            echo "2. Updating documentation as needed" >> $GITHUB_STEP_SUMMARY
+            echo "3. Announcing the release to users" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### ❌ Some release gates failed. Please review and fix before merging." >> $GITHUB_STEP_SUMMARY
+          fi
@@ -0,0 +1,181 @@
+name: 'PR into Dev'
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches:
+      - dev
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: read
+
+jobs:
+  validate-pr:
+    name: Validate PR Structure
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Fork safety check
+        id: fork-check
+        uses: ./.github/actions/fork-safety
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Validate branch name
+        id: branch-name
+        run: |
+          BRANCH_NAME="${{ github.head_ref }}"
+          echo "Branch name: $BRANCH_NAME"
+
+          # Valid prefixes for dev branch
+          VALID_PREFIXES="feature/ fix/ hotfix/ test/ refactor/ docs/"
+
+          VALID=false
+          for prefix in $VALID_PREFIXES; do
+            if [[ "$BRANCH_NAME" == $prefix* ]]; then
+              VALID=true
+              echo "✅ Branch name is valid (starts with $prefix)"
+              break
+            fi
+          done
+
+          if [ "$VALID" = false ]; then
+            echo "::error::Invalid branch name: $BRANCH_NAME"
+            echo "::error::Branch must start with one of: $VALID_PREFIXES"
+            echo "valid=false" >> $GITHUB_OUTPUT
+            exit 1
+          else
+            echo "valid=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate PR title (Conventional Commits)
+        id: pr-title
+        run: |
+          PR_TITLE="${{ github.event.pull_request.title }}"
+          echo "PR Title: $PR_TITLE"
+
+          # Conventional commit format: type(scope): subject
+          # Valid types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
+          if [[ ! "$PR_TITLE" =~ ^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?:\ .+ ]]; then
+            echo "::error::PR title does not follow Conventional Commits format"
+            echo "::error::Format: type(scope): subject"
+            echo "::error::Example: feat(installer): add Windows PowerShell support"
+            echo "::error::Valid types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert"
+            echo "valid=false" >> $GITHUB_OUTPUT
+            exit 1
+          else
+            echo "✅ PR title follows Conventional Commits format"
+            echo "valid=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check for linked issues
+        id: linked-issues
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER="${{ github.event.pull_request.number }}"
+          PR_BODY="${{ github.event.pull_request.body }}"
+
+          echo "Checking for linked issues in PR #$PR_NUMBER"
+
+          # Check for keywords like "Closes", "Fixes", "Resolves", "Relates to"
+          ISSUE_KEYWORDS="Closes|Fixes|Resolves|Relates to|Ref|References"
+
+          if echo "$PR_BODY" | grep -qiE "($ISSUE_KEYWORDS) #[0-9]+"; then
+            echo "✅ Found linked issue(s) in PR body"
+            echo "has-linked-issues=true" >> $GITHUB_OUTPUT
+          else
+            echo "::warning::No linked issues found in PR body"
+            echo "::warning::Please link at least one issue using keywords: Closes #123, Fixes #456, etc."
+            echo "has-linked-issues=false" >> $GITHUB_OUTPUT
+            # Not failing, just warning
+          fi
+
+      - name: Comment on validation failure
+        if: failure() && steps.fork-check.outputs.should-skip-writes != 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const branchValid = '${{ steps.branch-name.outputs.valid }}';
+            const titleValid = '${{ steps.pr-title.outputs.valid }}';
+
+            let comment = '## ❌ PR Validation Failed\n\n';
+
+            if (branchValid !== 'true') {
+              comment += '### Branch Name\n';
+              comment += '- ❌ Branch name must start with: `feature/`, `fix/`, `hotfix/`, `test/`, `refactor/`, or `docs/`\n';
+              comment += `- Current branch: \`${{ github.head_ref }}\`\n\n`;
+            }
+
+            if (titleValid !== 'true') {
+              comment += '### PR Title\n';
+              comment += '- ❌ PR title must follow Conventional Commits format\n';
+              comment += '- Format: `type(scope): subject`\n';
+              comment += '- Example: `feat(installer): add Windows PowerShell support`\n';
+              comment += '- Valid types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`, `revert`\n\n';
+            }
+
+            comment += '### How to Fix\n\n';
+            comment += '1. Rename your branch if needed: `git branch -m new-branch-name`\n';
+            comment += '2. Update PR title to follow Conventional Commits format\n';
+            comment += '3. Push changes and re-run checks\n\n';
+            comment += '📚 See [CONTRIBUTING.md](../blob/main/docs/CONTRIBUTING.md) for more details.';
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: comment
+            });
+
+  quality-checks:
+    name: Run Quality Checks
+    needs: validate-pr
+    uses: ./.github/workflows/reusable-pr-checks.yml
+    with:
+      python-version: '3.11'
+      skip-python: false
+      skip-markdown: false
+      skip-bash: false
+      skip-secrets: false
+
+  pr-summary:
+    name: PR Summary
+    needs: [validate-pr, quality-checks]
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Generate summary
+        run: |
+          echo "## 📋 PR into Dev - Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Validation Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ needs.validate-pr.result }}" == "success" ]]; then
+            echo "- ✅ PR structure validated" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- ❌ PR structure validation failed" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [[ "${{ needs.quality-checks.result }}" == "success" ]]; then
+            echo "- ✅ Quality checks passed" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- ❌ Quality checks failed" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ needs.validate-pr.result }}" == "success" ]] && [[ "${{ needs.quality-checks.result }}" == "success" ]]; then
+            echo "### ✅ All checks passed! PR is ready for review." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### ❌ Some checks failed. Please review and fix before merging." >> $GITHUB_STEP_SUMMARY
+          fi
@@ -0,0 +1,270 @@
+name: 'Create Release'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (e.g., 1.1.0)'
+        required: true
+        type: string
+      prerelease:
+        description: 'Mark as pre-release'
+        required: false
+        default: false
+        type: boolean
+      draft:
+        description: 'Create as draft'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: write
+  pull-requests: read
+  issues: write
+
+jobs:
+  validate-release:
+    name: Validate Release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate version format
+        id: validate-version
+        run: |
+          VERSION="${{ inputs.version }}"
+          echo "Validating version: $VERSION"
+
+          # Check semantic versioning format
+          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "✅ Version format is valid"
+            echo "valid=true" >> $GITHUB_OUTPUT
+          else
+            echo "::error::Invalid version format: $VERSION"
+            echo "::error::Must be semantic versioning (e.g., 1.1.0 or 1.1.0-beta.1)"
+            echo "valid=false" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+      - name: Check if tag already exists
+        id: check-tag
+        run: |
+          VERSION="${{ inputs.version }}"
+          TAG="v$VERSION"
+
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "::error::Tag $TAG already exists"
+            echo "::error::Please use a different version number"
+            echo "exists=true" >> $GITHUB_OUTPUT
+            exit 1
+          else
+            echo "✅ Tag $TAG is available"
+            echo "exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate CHANGELOG.md
+        id: check-changelog
+        run: |
+          VERSION="${{ inputs.version }}"
+
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "::warning::CHANGELOG.md not found"
+            echo "updated=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          # Check if version is mentioned in CHANGELOG
+          if grep -q "\[$VERSION\]" CHANGELOG.md || grep -q "## $VERSION" CHANGELOG.md; then
+            echo "✅ Version $VERSION found in CHANGELOG.md"
+            echo "updated=true" >> $GITHUB_OUTPUT
+          else
+            echo "::warning::Version $VERSION not found in CHANGELOG.md"
+            echo "::warning::Consider adding release notes before creating release"
+            echo "updated=false" >> $GITHUB_OUTPUT
+          fi
+
+  create-release:
+    name: Create GitHub Release
+    needs: validate-release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Rate limit check
+        uses: ./.github/actions/rate-limit-check
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          minimum-remaining: 100
+
+      - name: Extract release notes from CHANGELOG
+        id: extract-notes
+        run: |
+          VERSION="${{ inputs.version }}"
+
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "CHANGELOG.md not found, using default release notes"
+            NOTES="Release v$VERSION
+
+See the full changelog at https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md"
+          else
+            # Try to extract notes for this version
+            # Look for section between [VERSION] and next [VERSION] or end of file
+            NOTES=$(awk "/\[$VERSION\]|## $VERSION/,/^## \[|^## [0-9]/" CHANGELOG.md | tail -n +2 | head -n -1)
+
+            if [ -z "$NOTES" ]; then
+              echo "No specific notes found for $VERSION in CHANGELOG.md"
+              NOTES="Release v$VERSION
+
+See the full changelog at https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md"
+            else
+              echo "✅ Extracted release notes from CHANGELOG.md"
+            fi
+          fi
+
+          # Save to file for GitHub release
+          echo "$NOTES" > /tmp/release-notes.md
+          echo "notes-file=/tmp/release-notes.md" >> $GITHUB_OUTPUT
+
+      - name: Get commits since last release
+        id: get-commits
+        run: |
+          # Get the last release tag
+          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+
+          if [ -z "$LAST_TAG" ]; then
+            echo "No previous tags found, getting all commits"
+            COMMITS=$(git log --pretty=format:"- %s (%h)" --no-merges)
+          else
+            echo "Getting commits since $LAST_TAG"
+            COMMITS=$(git log ${LAST_TAG}..HEAD --pretty=format:"- %s (%h)" --no-merges)
+          fi
+
+          echo "$COMMITS" > /tmp/commits.txt
+          echo "commits-file=/tmp/commits.txt" >> $GITHUB_OUTPUT
+
+      - name: Create release notes
+        run: |
+          VERSION="${{ inputs.version }}"
+          TAG="v$VERSION"
+
+          # Combine CHANGELOG notes with commit list
+          cat /tmp/release-notes.md > /tmp/final-notes.md
+
+          echo "" >> /tmp/final-notes.md
+          echo "---" >> /tmp/final-notes.md
+          echo "" >> /tmp/final-notes.md
+          echo "## 📦 Installation" >> /tmp/final-notes.md
+          echo "" >> /tmp/final-notes.md
+          echo "### One-Line Install (Recommended)" >> /tmp/final-notes.md
+          echo '```bash' >> /tmp/final-notes.md
+          echo "curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/main/install.sh | bash" >> /tmp/final-notes.md
+          echo '```' >> /tmp/final-notes.md
+          echo "" >> /tmp/final-notes.md
+          echo "### Manual Install" >> /tmp/final-notes.md
+          echo '```bash' >> /tmp/final-notes.md
+          echo "wget https://github.com/${{ github.repository }}/archive/refs/tags/$TAG.tar.gz" >> /tmp/final-notes.md
+          echo "tar -xzf $TAG.tar.gz" >> /tmp/final-notes.md
+          echo "cd ClaudeForge-${VERSION}" >> /tmp/final-notes.md
+          echo "./install.sh" >> /tmp/final-notes.md
+          echo '```' >> /tmp/final-notes.md
+          echo "" >> /tmp/final-notes.md
+          echo "📚 **Documentation**: https://github.com/${{ github.repository }}/blob/main/docs/INSTALLATION.md" >> /tmp/final-notes.md
+          echo "" >> /tmp/final-notes.md
+
+          if [ -s /tmp/commits.txt ]; then
+            echo "## 📝 Commits" >> /tmp/final-notes.md
+            echo "" >> /tmp/final-notes.md
+            cat /tmp/commits.txt >> /tmp/final-notes.md
+            echo "" >> /tmp/final-notes.md
+          fi
+
+          echo "---" >> /tmp/final-notes.md
+          echo "" >> /tmp/final-notes.md
+          echo "**Full Changelog**: https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md" >> /tmp/final-notes.md
+
+      - name: Create GitHub Release
+        id: create-release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${{ inputs.version }}"
+          TAG="v$VERSION"
+          DRAFT_FLAG=""
+          PRERELEASE_FLAG=""
+
+          if [[ "${{ inputs.draft }}" == "true" ]]; then
+            DRAFT_FLAG="--draft"
+          fi
+
+          if [[ "${{ inputs.prerelease }}" == "true" ]]; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+
+          gh release create "$TAG" \
+            --title "ClaudeForge $TAG" \
+            --notes-file /tmp/final-notes.md \
+            $DRAFT_FLAG \
+            $PRERELEASE_FLAG
+
+          echo "✅ Release $TAG created successfully"
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+
+      - name: Update installation script references
+        if: inputs.prerelease == false && inputs.draft == false
+        run: |
+          VERSION="${{ inputs.version }}"
+          echo "::notice::Consider updating installer script to reference $VERSION"
+          echo "::notice::Files to update: install.sh, install.ps1 (if they contain version references)"
+
+  release-summary:
+    name: Release Summary
+    needs: [validate-release, create-release]
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Generate summary
+        run: |
+          VERSION="${{ inputs.version }}"
+          TAG="v$VERSION"
+
+          echo "## 🎉 Release Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ needs.validate-release.result }}" == "success" ]] && \
+             [[ "${{ needs.create-release.result }}" == "success" ]]; then
+            echo "### ✅ Release $TAG Created Successfully!" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "🔗 **Release URL**: https://github.com/${{ github.repository }}/releases/tag/$TAG" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "1. ✅ Release created on GitHub" >> $GITHUB_STEP_SUMMARY
+
+            if [[ "${{ inputs.draft }}" == "true" ]]; then
+              echo "2. ⚠️ Release is in **DRAFT** mode - publish when ready" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            if [[ "${{ inputs.prerelease }}" == "true" ]]; then
+              echo "3. ⚠️ Marked as **PRE-RELEASE**" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "4. Consider announcing the release:" >> $GITHUB_STEP_SUMMARY
+            echo "   - Update README.md badges if needed" >> $GITHUB_STEP_SUMMARY
+            echo "   - Post announcement in Discussions" >> $GITHUB_STEP_SUMMARY
+            echo "   - Share on social media if applicable" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### ❌ Release Creation Failed" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Please check the workflow logs for details." >> $GITHUB_STEP_SUMMARY
+          fi
@@ -0,0 +1,127 @@
+name: 'Reusable PR Quality Checks'
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        description: 'Python version to use'
+        required: false
+        default: '3.11'
+        type: string
+      skip-python:
+        description: 'Skip Python validation'
+        required: false
+        default: false
+        type: boolean
+      skip-markdown:
+        description: 'Skip Markdown validation'
+        required: false
+        default: false
+        type: boolean
+      skip-bash:
+        description: 'Skip Bash validation'
+        required: false
+        default: false
+        type: boolean
+      skip-secrets:
+        description: 'Skip secret scanning'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  quality-gates:
+    name: Quality Gates
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Fork safety check
+        id: fork-check
+        uses: ./.github/actions/fork-safety
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Rate limit check
+        uses: ./.github/actions/rate-limit-check
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          minimum-remaining: 50
+
+      - name: Run quality gates
+        id: quality
+        uses: ./.github/actions/quality-gates
+        with:
+          python-version: ${{ inputs.python-version }}
+          skip-python: ${{ inputs.skip-python }}
+          skip-markdown: ${{ inputs.skip-markdown }}
+          skip-bash: ${{ inputs.skip-bash }}
+          skip-secrets: ${{ inputs.skip-secrets }}
+
+      - name: Quality check summary
+        run: |
+          echo "## 🔍 Quality Gates Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          PYTHON_PASSED="${{ steps.quality.outputs.python-passed }}"
+          MARKDOWN_PASSED="${{ steps.quality.outputs.markdown-passed }}"
+          BASH_PASSED="${{ steps.quality.outputs.bash-passed }}"
+          SECRETS_PASSED="${{ steps.quality.outputs.secrets-passed }}"
+          ALL_PASSED="${{ steps.quality.outputs.all-passed }}"
+
+          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ inputs.skip-python }}" != "true" ]]; then
+            if [[ "$PYTHON_PASSED" == "true" ]]; then
+              echo "| Python Syntax | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Python Syntax | ❌ Failed |" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+
+          if [[ "${{ inputs.skip-markdown }}" != "true" ]]; then
+            if [[ "$MARKDOWN_PASSED" == "true" ]]; then
+              echo "| Markdown Lint | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Markdown Lint | ❌ Failed |" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+
+          if [[ "${{ inputs.skip-bash }}" != "true" ]]; then
+            if [[ "$BASH_PASSED" == "true" ]]; then
+              echo "| Bash Scripts | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Bash Scripts | ❌ Failed |" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+
+          if [[ "${{ inputs.skip-secrets }}" != "true" ]]; then
+            if [[ "$SECRETS_PASSED" == "true" ]]; then
+              echo "| Secret Scan | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Secret Scan | ⚠️ Warnings |" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "$ALL_PASSED" == "true" ]]; then
+            echo "### ✅ All quality gates passed!" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### ❌ Some quality gates failed" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Please review the errors above and fix them before merging." >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: Fail if quality gates failed
+        if: steps.quality.outputs.all-passed != 'true'
+        run: |
+          echo "::error::Quality gates failed. Please review and fix the issues."
+          exit 1