WillieCubed · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.claude/settings.json b/.claude/settings.json
@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.5.4"
+        "ref": "v0.7.1"
       }
     }
   },

diff --git a/.github/actions/setup-node-pnpm/action.yml b/.github/actions/setup-node-pnpm/action.yml
@@ -1,3 +1,5 @@
+# Managed by LasVegasForTransit/repository-tooling. Do not edit this file;
+# `pnpm check:repository-tooling` fails on local changes.
 name: Setup Node + pnpm
 description: Install the repository's pinned pnpm, cache its store, and install from the lockfile.
 
@@ -22,3 +24,32 @@ runs:
       run: pnpm install --frozen-lockfile
       env:
         NODE_AUTH_TOKEN: ${{ github.token }}
+
+    - name: Install reviewed secret scanner
+      if: ${{ hashFiles('.gitleaks.toml') != '' }}
+      shell: bash
+      run: |
+        case "$RUNNER_OS/$RUNNER_ARCH" in
+          Linux/X64)
+            scanner_archive=gitleaks_8.30.1_linux_x64.tar.gz
+            scanner_sha=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+            ;;
+          Linux/ARM64)
+            scanner_archive=gitleaks_8.30.1_linux_arm64.tar.gz
+            scanner_sha=e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080
+            ;;
+          *) echo "Unsupported scanner runner: $RUNNER_OS/$RUNNER_ARCH" >&2; exit 1 ;;
+        esac
+        scanner_directory="$(mktemp -d "$RUNNER_TEMP/lvbt-gitleaks.XXXXXX")"
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/$scanner_archive" \
+          --output "$scanner_directory/$scanner_archive"
+        scanner_actual="$(sha256sum "$scanner_directory/$scanner_archive" | cut -d ' ' -f 1)"
+        if [ "$scanner_actual" != "$scanner_sha" ]; then
+          echo 'Scanner archive checksum did NOT match the reviewed release.' >&2
+          exit 1
+        fi
+        tar -xzf "$scanner_directory/$scanner_archive" -C "$scanner_directory" gitleaks
+        chmod +x "$scanner_directory/gitleaks"
+        test "$("$scanner_directory/gitleaks" version)" = '8.30.1'
+        echo "$scanner_directory" >> "$GITHUB_PATH"
diff --git a/.github/workflows/audit-scheduled.yml b/.github/workflows/audit-scheduled.yml
@@ -0,0 +1,20 @@
+name: Audit (scheduled)
+
+on:
+  schedule:
+    - cron: '0 14 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+  actions: read
+  issues: write
+
+concurrency:
+  group: shared-audits-${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  audit:
+    uses: LasVegasForTransit/repository-tooling/.github/workflows/audit.yml@3567f0cb1345e8756eb5d84e0a3ea7b62695125a
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -33,13 +33,3 @@ jobs:
 
       - name: Check
         run: pnpm check
-
-      - name: Dependency audit
-        run: pnpm audit --audit-level=high
-
-      - name: Secret scan
-        run: |
-          set -euo pipefail
-          docker run --rm -v "$PWD:/repo" -w /repo \
-            ghcr.io/gitleaks/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
-            git --redact --no-banner --config /repo/.gitleaks.toml
diff --git a/.lvbt/tooling.json b/.lvbt/tooling.json
@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "audits": {
+    "workflow": ".github/workflows/audit-scheduled.yml",
+    "artifactName": "lvbt-audit-report",
+    "dependencies": {
+      "local": {
+        "command": ["pnpm", "audit", "--prod", "--audit-level=high", "--json"],
+        "format": "pnpm"
+      },
+      "production": {
+        "command": ["pnpm", "audit", "--prod", "--audit-level=high", "--json"],
+        "format": "pnpm"
+      }
+    }
+  }
+}
diff --git a/.lvbt/web-platform.json b/.lvbt/web-platform.json
@@ -1,9 +1,9 @@
 {
   "formatVersion": 1,
   "preset": "lvbt-web",
-  "release": "v0.5.4",
-  "commit": "323d5f5f968ed69ebcc29252b183fd65d13dc49a",
-  "contentHash": "25da315541c7a6f94f1ed1712e7b41c7512318af88033a1b3d485515d350ab83",
+  "release": "v0.7.1",
+  "commit": "dfc9bddfc0a9c5d596c26496a9e6b6ed732d4ef3",
+  "contentHash": "9fc709c4ebf7edd8665cbdb81f6b5c73172b6c4fc1b8261173e975a35c359811",
   "executables": [
     "examples/with-astro/.githooks/commit-msg",
     "examples/with-astro/.githooks/pre-commit",

diff --git a/.lvbt/web-platform/examples/with-astro/.claude/settings.json b/.lvbt/web-platform/examples/with-astro/.claude/settings.json
@@ -4,7 +4,7 @@
       "source": {
         "source": "github",
         "repo": "LasVegasForTransit/repository-tooling",
-        "ref": "v0.5.4"
+        "ref": "v0.7.1"
       }
     }
   },

diff --git a/.lvbt/web-platform/examples/with-astro/.github/actions/setup-node-pnpm/action.yml b/.lvbt/web-platform/examples/with-astro/.github/actions/setup-node-pnpm/action.yml
@@ -1,3 +1,5 @@
+# Managed by LasVegasForTransit/repository-tooling. Do not edit this file;
+# `pnpm check:repository-tooling` fails on local changes.
 name: Setup Node + pnpm
 description: Install the repository's pinned pnpm, cache its store, and install from the lockfile.
 
@@ -22,3 +24,32 @@ runs:
       run: pnpm install --frozen-lockfile
       env:
         NODE_AUTH_TOKEN: ${{ github.token }}
+
+    - name: Install reviewed secret scanner
+      if: ${{ hashFiles('.gitleaks.toml') != '' }}
+      shell: bash
+      run: |
+        case "$RUNNER_OS/$RUNNER_ARCH" in
+          Linux/X64)
+            scanner_archive=gitleaks_8.30.1_linux_x64.tar.gz
+            scanner_sha=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+            ;;
+          Linux/ARM64)
+            scanner_archive=gitleaks_8.30.1_linux_arm64.tar.gz
+            scanner_sha=e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080
+            ;;
+          *) echo "Unsupported scanner runner: $RUNNER_OS/$RUNNER_ARCH" >&2; exit 1 ;;
+        esac
+        scanner_directory="$(mktemp -d "$RUNNER_TEMP/lvbt-gitleaks.XXXXXX")"
+        curl --fail --silent --show-error --location --retry 3 \
+          "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/$scanner_archive" \
+          --output "$scanner_directory/$scanner_archive"
+        scanner_actual="$(sha256sum "$scanner_directory/$scanner_archive" | cut -d ' ' -f 1)"
+        if [ "$scanner_actual" != "$scanner_sha" ]; then
+          echo 'Scanner archive checksum did NOT match the reviewed release.' >&2
+          exit 1
+        fi
+        tar -xzf "$scanner_directory/$scanner_archive" -C "$scanner_directory" gitleaks
+        chmod +x "$scanner_directory/gitleaks"
+        test "$("$scanner_directory/gitleaks" version)" = '8.30.1'
+        echo "$scanner_directory" >> "$GITHUB_PATH"
diff --git a/.lvbt/web-platform/examples/with-astro/.github/workflows/audit-scheduled.yml b/.lvbt/web-platform/examples/with-astro/.github/workflows/audit-scheduled.yml
@@ -0,0 +1,20 @@
+name: Audit (scheduled)
+
+on:
+  schedule:
+    - cron: '0 14 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+  actions: read
+  issues: write
+
+concurrency:
+  group: shared-audits-${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  audit:
+    uses: LasVegasForTransit/repository-tooling/.github/workflows/audit.yml@3567f0cb1345e8756eb5d84e0a3ea7b62695125a
diff --git a/.lvbt/web-platform/examples/with-astro/.github/workflows/ci.yml b/.lvbt/web-platform/examples/with-astro/.github/workflows/ci.yml
@@ -33,13 +33,3 @@ jobs:
 
       - name: Check
         run: pnpm check
-
-      - name: Dependency audit
-        run: pnpm audit --audit-level=high
-
-      - name: Secret scan
-        run: |
-          set -euo pipefail
-          docker run --rm -v "$PWD:/repo" -w /repo \
-            ghcr.io/gitleaks/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
-            git --redact --no-banner --config /repo/.gitleaks.toml
diff --git a/.lvbt/web-platform/examples/with-astro/.github/workflows/deploy.yml b/.lvbt/web-platform/examples/with-astro/.github/workflows/deploy.yml
@@ -1,7 +1,4 @@
-# Deploys every app with a wrangler config on each push to main, after the
-# same check pull requests run. Needs the CLOUDFLARE_API_TOKEN (Workers Scripts
-# edit) and CLOUDFLARE_ACCOUNT_ID repository secrets.
-name: Deploy
+name: Deploy staging
 
 on:
   push:
@@ -10,33 +7,45 @@ on:
 
 permissions:
   contents: read
+  actions: read
+  deployments: write
+  packages: read
 
 concurrency:
-  group: deploy-${{ github.ref }}
+  group: staging
   cancel-in-progress: false
 
 jobs:
-  validate:
-    name: Validate
-    uses: ./.github/workflows/ci.yml
+  build:
+    uses: LasVegasForTransit/repository-tooling/.github/workflows/release-build.yml@3567f0cb1345e8756eb5d84e0a3ea7b62695125a
+    with:
+      app-directory: apps/deploy
+      artifact-prefix: app-release
+    secrets: inherit
+  attest:
+    needs: build
+    permissions:
+      contents: read
+      actions: read
+      packages: read
+      attestations: write
+      id-token: write
+    uses: LasVegasForTransit/repository-tooling/.github/workflows/release-attest.yml@3567f0cb1345e8756eb5d84e0a3ea7b62695125a
+    with:
+      artifact-prefix: app-release
 
-  deploy:
-    name: Deploy
-    needs: validate
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    environment: production
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup Node + pnpm
-        uses: ./.github/actions/setup-node-pnpm
-
-      - name: Deploy
-        run: pnpm run deploy
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  staging:
+    needs: [build, attest]
+    uses: LasVegasForTransit/repository-tooling/.github/workflows/release-publish.yml@3567f0cb1345e8756eb5d84e0a3ea7b62695125a
+    with:
+      target: preview
+      attestation-prefix: attestation-app-release
+      release-id: ${{ github.run_id }}
+      commit: ${{ github.sha }}
+      artifact-prefix: app-release
+      app-directory: apps/deploy
+      acceptance-directory: apps/site
+      url: ${{ vars.LVBT_PREVIEW_URL }}
+      smoke-script: worker:smoke
+      browser-script: worker:test:browser
+    secrets: inherit
diff --git a/.lvbt/web-platform/examples/with-astro/.github/workflows/promote.yml b/.lvbt/web-platform/examples/with-astro/.github/workflows/promote.yml
@@ -0,0 +1,53 @@
+name: Promote app release
+run-name: "Promote app: ${{ inputs.request_id || inputs.run_id || 'current preview' }}"
+
+on:
+  workflow_dispatch:
+    inputs:
+      run_id:
+        description: Optional successful Deploy staging run ID; omit to select the actual preview
+        type: string
+        required: false
+      request_id:
+        description: Correlation ID supplied by lvbt promote
+        type: string
+        required: false
+
+      expected_version:
+        description: Optional current production version; required before a release marker exists
+        type: string
+        required: false
+
+permissions:
+  contents: read
+  actions: read
+  deployments: write
+  packages: read
+
+concurrency:
+  group: production
+  cancel-in-progress: false
+
+jobs:
+  source:
+    if: github.ref == 'refs/heads/main'
+    uses: LasVegasForTransit/repository-tooling/.github/workflows/release-source.yml@3567f0cb1345e8756eb5d84e0a3ea7b62695125a
+    with:
+      run-id: ${{ inputs.run_id }}
+    secrets: inherit
+  promote:
+    needs: source
+    uses: LasVegasForTransit/repository-tooling/.github/workflows/release-publish.yml@3567f0cb1345e8756eb5d84e0a3ea7b62695125a
+    with:
+      target: production
+      expected-version: ${{ inputs.expected_version }}
+      attestation-prefix: attestation-app-release
+      release-id: ${{ needs.source.outputs.release-id }}
+      commit: ${{ needs.source.outputs.commit }}
+      artifact-prefix: app-release
+      app-directory: apps/deploy
+      acceptance-directory: apps/site
+      url: ${{ vars.LVBT_PRODUCTION_URL }}
+      smoke-script: worker:smoke
+      browser-script: worker:test:browser
+    secrets: inherit
diff --git a/.lvbt/web-platform/examples/with-astro/.gitignore b/.lvbt/web-platform/examples/with-astro/.gitignore
@@ -7,6 +7,7 @@ blob-report/
 **/playwright/.cache/
 .turbo/
 .wrangler/
+.cloudflare/
 .env
 .env.*
 !.env.example

diff --git a/.lvbt/web-platform/examples/with-astro/.lvbt/tooling.json b/.lvbt/web-platform/examples/with-astro/.lvbt/tooling.json
@@ -0,0 +1,41 @@
+{
+  "version": 1,
+  "release": {
+    "appDirectory": "apps/deploy",
+    "artifactSource": "cf-output",
+    "productionWorker": "lvbt-site",
+    "previewWorker": "lvbt-site-preview",
+    "productionUrlEnv": "LVBT_PRODUCTION_URL",
+    "previewUrlEnv": "LVBT_PREVIEW_URL",
+    "artifactPrefix": "app-release",
+    "stagingWorkflow": {
+      "name": "Deploy staging",
+      "path": ".github/workflows/deploy.yml",
+      "branch": "main"
+    },
+    "promotionWorkflow": {
+      "file": "promote.yml",
+      "titlePrefix": "Promote app",
+      "branch": "main"
+    },
+    "workersDevSubdomainEnv": "LVBT_WORKERS_DEV_SUBDOMAIN",
+    "attestation": {
+      "signerWorkflow": "LasVegasForTransit/repository-tooling/.github/workflows/release-attest.yml",
+      "signerCommit": "3567f0cb1345e8756eb5d84e0a3ea7b62695125a"
+    }
+  },
+  "audits": {
+    "workflow": ".github/workflows/audit-scheduled.yml",
+    "artifactName": "lvbt-audit-report",
+    "dependencies": {
+      "local": {
+        "command": ["pnpm", "audit", "--prod", "--audit-level=high", "--json"],
+        "format": "pnpm"
+      },
+      "production": {
+        "command": ["pnpm", "audit", "--prod", "--audit-level=high", "--json"],
+        "format": "pnpm"
+      }
+    }
+  }
+}