Refactor repository automation into project_setup

.env.example

@@ -0,0 +1,13 @@
+# Copy this file to .env before running local live operations.
+# Never commit .env or paste tokens into issues, logs, or pull requests.
+
+# Target repository in owner/repository format.
+GITHUB_REPOSITORY=owner/repository
+
+# Required for GitHub Projects v2 creation and synchronization.
+# Create a personal access token (classic) with `repo` and `project` scopes.
+# Leave empty when you only use dry-run or repository-scoped GitHub Actions.
+PROJECT_SETUP_PAT=
+
+# Optional path to the local setup configuration.
+PROJECT_SETUP_CONFIG=project_setup.json

.github/CODEOWNERS

@@ -1,5 +1,8 @@
-# Optional fallback ownership for governance files
+# Fallback ownership for project setup and repository automation files
 /.github/ @v-Kaefer
+/project_setup/ @v-Kaefer
 /config/ @v-Kaefer
 /docs/repo/ @v-Kaefer
-/scripts/github/ @v-Kaefer
+/scripts/validation/ @v-Kaefer
+/Makefile @v-Kaefer
+/pyproject.toml @v-Kaefer

.github/pull_request_template.md

@@ -1,26 +1,26 @@
 ## Linked Issue
-- Closes #<issue-number>  <!-- use N/A if there is no linked issue: Closes #N/A -->
+- Closes #<issue-number>
 
 ## Milestone
-- MS0
+- <milestone>
 
 ## Summary
--
+- <what changed and why>
 
 ## How to test
 - Test type: automated | smoke | manual
-- Steps: describe the commands, manual flow, or verification evidence
+- Steps: <commands or manual verification flow>
 
 ## Evidence
-- [ ] Screenshot/GIF attached (when applicable)
-- [ ] Log/output attached (when applicable)
-- [ ] Manual checklist executed (when applicable)
+- [ ] Screenshot/GIF attached when applicable
+- [ ] Log/output attached when applicable
+- [ ] Manual checklist executed when applicable
 
 ## Known risks
--
+- <known limitations or explicitly state None>
 
 ## DoD checklist
 - [ ] Scope implemented as defined
 - [ ] Tests executed and documented
-- [ ] Evidence attached
+- [ ] Evidence attached when applicable
 - [ ] No known critical breakage introduced

.github/workflows/auto-label.yml

@@ -3,32 +3,33 @@ name: Auto label
 on:
   issues:
     types: [opened, edited, reopened]
-  pull_request:
+  pull_request_target:
     types: [opened, edited, reopened, synchronize]
 
 permissions:
   contents: read
   issues: write
-  pull-requests: read
+
+concurrency:
+  group: auto-label-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
 
 jobs:
   auto-label:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Python
-        uses: actions/setup-python@v5
+      - name: Checkout trusted repository automation
+        uses: actions/checkout@v6
         with:
-          python-version: '3.11'
+          ref: ${{ github.event.pull_request.base.sha || github.sha }}
+          persist-credentials: false
 
-      - name: Install governance tool
-        run: pip install -e . --quiet
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
 
       - name: Apply inferred labels
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_EVENT_PATH: ${{ github.event_path }}
-        run: python -m governance_bootstrap auto-label apply
+          GITHUB_TOKEN: ${{ github.token }}
+        run: python -m project_setup auto-label apply --live

.github/workflows/main-source-branch.yml

@@ -8,26 +8,35 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: main-source-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   validate-main-source:
     name: validate-main-source
     runs-on: ubuntu-latest
     steps:
-      - name: Ensure PR to main comes from develop
+      - name: Ensure PR to main comes from develop or hotfix
         shell: bash
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
           HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
           EXPECTED_REPO: ${{ github.repository }}
         run: |
+          set -euo pipefail
           echo "Base: $BASE_REF"
           echo "Head: $HEAD_REPO:$HEAD_REF"
           if [[ "$BASE_REF" != "main" ]]; then
-            echo "This workflow only validates PRs targeting main."
+            echo "This workflow only validates PRs targeting main." >&2
+            exit 1
+          fi
+          if [[ "$HEAD_REPO" != "$EXPECTED_REPO" ]]; then
+            echo "PRs targeting main must come from the same repository." >&2
             exit 1
           fi
-          if [[ "$HEAD_REPO" != "$EXPECTED_REPO" || "$HEAD_REF" != "develop" ]]; then
-            echo "PRs targeting main must come from $EXPECTED_REPO:develop." >&2
+          if [[ "$HEAD_REF" != "develop" && ! "$HEAD_REF" =~ ^hotfix/[a-z0-9._/-]+$ ]]; then
+            echo "PRs targeting main must come from develop or hotfix/*." >&2
             exit 1
           fi

.github/workflows/pr-metadata.yml

@@ -1,32 +1,46 @@
 name: PR metadata validation
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened, edited]
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited, ready_for_review]
 
 permissions:
   contents: read
+  issues: write
+
+concurrency:
+  group: pr-metadata-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
-  validate-pr-body:
-    # Draft PRs are works-in-progress; skip validation until they are marked ready.
+  validate-pr:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - name: Ensure required PR sections and issue link
+      - name: Checkout trusted base commit
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Validate branch name and pull request metadata
         env:
           PR_BODY: ${{ github.event.pull_request.body }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
-          required=("Linked Issue" "Summary" "How to test")
-          for section in "${required[@]}"; do
-            if ! echo "$PR_BODY" | grep -qF "## $section"; then
-              echo "Missing required PR section: ## $section" >&2
-              exit 1
-            fi
-          done
-          # Accept a real issue number (Closes/Fixes/Resolves #NNN) or an explicit N/A
-          # when there is genuinely no linked issue.
-          if ! echo "$PR_BODY" | grep -qE 'Closes #[0-9]+|Fixes #[0-9]+|Resolves #[0-9]+|Closes #[Nn][/\\]?[Aa]|#N/A|#n/a'; then
-            echo "PR body must reference a linked issue (e.g. Closes #123) or mark it as not applicable (Closes #N/A)" >&2
-            exit 1
-          fi
+          set -euo pipefail
+          python scripts/validation/validate_pr_body.py \
+            --branch "$HEAD_REF" \
+            --base-branch "$BASE_REF" \
+            --repo "$REPOSITORY" \
+            --pr-number "$PR_NUMBER" \
+            --comment