create-repository.yml

name: Create Bootstrap Repository

on:
  workflow_dispatch:
    inputs:
      repo_name:
        description: "New repository name"
        required: true
        type: string
      repo_owner:
        description: "Repository owner (user/org)"
        required: false
        type: string
      repo_description:
        description: "Repository description"
        required: false
        default: "Repository following SOLID principles and best practices"
        type: string
      visibility:
        description: "Repository visibility"
        required: false
        default: "public"
        type: choice
        options:
          - public
          - private
          - internal
      cleanup_on_failure:
        description: "Delete repository if creation fails"
        required: false
        default: true
        type: boolean
      team_name:
        description: "GitHub team for code owners (e.g., org/team-leads)"
        required: false
        default: "team-leads"
        type: string
      license_holder:
        description: "License copyright holder name"
        required: false
        type: string
      languages:
        description: "Programming languages. For tooling templates, the first language is used (e.g. python,typescript). Use 'all' for monorepo metadata/workflow configuration."
        required: false
        default: "language-agnostic-only"
        type: string
      env_manager:
        description: "Environment manager for local tooling"
        required: true
        type: choice
        options:
          - micromamba
          - mise
          - system
      python_version:
        description: "Python runtime version for generated tooling (default: latest stable)"
        required: false
        default: "3.13"
        type: choice
        options:
          - "3.13"
          - "3.12"
      node_version:
        description: "Node.js major LTS version for generated tooling"
        required: false
        default: "24"
        type: choice
        options:
          - "24"
          - "22"
      go_version:
        description: "Go stable version for generated tooling"
        required: false
        default: "1.26"
        type: choice
        options:
          - "1.26"
          - "1.25"
      java_version:
        description: "Java LTS version for generated tooling"
        required: false
        default: "25"
        type: choice
        options:
          - "25"
          - "21"
      release_tool:
        description: >-
          Release automation tool:
          'git-cliff' (tag-triggered, fast changelog, any language),
          'release-please' (PR-based, auto-bumps version files),
          'semantic-release' (push-to-main, fully automated, any language)
        required: false
        default: "git-cliff"
        type: choice
        options:
          - git-cliff
          - release-please
          - semantic-release
      enable_repo_settings:
        description: >-
          Apply repository settings PATCH, create dev/prod environments, and
          enable Dependabot security updates. Repository ruleset application is
          handled separately and is not controlled by this toggle.
        required: false
        default: true
        type: boolean
      enable_codeowners:
        description: "Add a CODEOWNERS file assigning the chosen team as default reviewer"
        required: false
        default: true
        type: boolean
      workflows:
        description: >-
          Comma-separated list of workflows to include, or 'all' to keep
          everything, or 'none' to skip all. Valid names: lint, codeql,
          ai-code-review, release.
        required: false
        default: "all"
        type: string
      github_host:
        description: >-
          GitHub hostname. Use 'github.com' for GitHub.com or your GHES
          hostname (e.g. 'ghes.example.com') for Enterprise Server.
        required: false
        default: "github.com"
        type: string
      gh_token:
        description: >-
          Personal Access Token with repo and admin:org scopes.
          WARNING: This input is NOT treated as a secret — its value may be
          visible in the run's inputs/metadata to anyone who can view the run.
          Prefer using the repository secret GH_PAT whenever possible.
          Only use this input when you do not have permission to set repository
          secrets and use a short-lived token with minimum required scopes.
        required: false
        type: string
      app_id:
        description: "GitHub App ID for App-based auth (recommended)"
        required: false
        type: string
      app_owner:
        description: "Owner (user/org) whose GitHub App installation token should be used"
        required: false
        type: string
      allowed_repo_owners:
        description: "Optional comma-separated allowlist of permitted target owners"
        required: false
        type: string
      require_cleanup_approval:
        description: "Require environment approval before deleting a failed repo"
        required: false
        default: true
        type: boolean
  workflow_call:
    inputs:
      repo_name:
        required: true
        type: string
      repo_owner:
        required: false
        type: string
      repo_description:
        required: false
        default: "Repository following SOLID principles and best practices"
        type: string
      visibility:
        required: false
        default: "public"
        type: string
      cleanup_on_failure:
        required: false
        default: true
        type: boolean
      team_name:
        required: false
        default: "team-leads"
        type: string
      license_holder:
        required: false
        type: string
      languages:
        required: false
        default: "language-agnostic-only"
        type: string
      env_manager:
        required: true
        type: string
      python_version:
        required: false
        default: "3.13"
        type: string
      node_version:
        required: false
        default: "24"
        type: string
      go_version:
        required: false
        default: "1.26"
        type: string
      java_version:
        required: false
        default: "25"
        type: string
      release_tool:
        required: false
        default: "git-cliff"
        type: string
      enable_repo_settings:
        required: false
        default: true
        type: boolean
      enable_codeowners:
        required: false
        default: true
        type: boolean
      workflows:
        required: false
        default: "all"
        type: string
      github_host:
        required: false
        default: "github.com"
        type: string
      gh_token:
        required: false
        type: string
      app_id:
        required: false
        type: string
      app_owner:
        required: false
        type: string
      allowed_repo_owners:
        required: false
        type: string
      require_cleanup_approval:
        required: false
        default: true
        type: boolean
    secrets:
      GH_PAT:
        required: false
      app_private_key:
        required: false
      BOOTSTRAP_APP_PRIVATE_KEY:
        required: false

jobs:
  create-repository:
    name: Create Repository
    runs-on: ubuntu-latest
    env:
      GH_HOST: ${{ inputs.github_host || 'github.com' }}
    outputs:
      owner: ${{ steps.set-owner.outputs.owner }}
      repo_created: ${{ steps.create-repo.outputs.repo_created }}
    permissions:
      contents: read

    steps:
      - name: Resolve bootstrap repository
        id: bootstrap-repo
        shell: bash
        run: |
          # workflow_ref format: owner/repo/.github/workflows/file.yml@refs/...
          # Always derive from workflow_ref so workflow_call from a different repo
          # checks out the bootstrap repo, not the caller's repo.
          REPO=$(printf '%s' '${{ github.workflow_ref }}' | cut -d'/' -f1,2)
          echo "repository=$REPO" >> "$GITHUB_OUTPUT"

      - name: Checkout bootstrap repository
        uses: actions/checkout@v7
        with:
          repository: ${{ steps.bootstrap-repo.outputs.repository }}
          ref: ${{ github.workflow_sha }}

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: tools/go.mod
          cache-dependency-path: tools/go.mod

      - name: Set repository owner
        id: set-owner
        run: |
          if [ -z "${{ inputs.repo_owner }}" ]; then
            echo "owner=${{ github.repository_owner }}" >> $GITHUB_OUTPUT
          else
            echo "owner=${{ inputs.repo_owner }}" >> $GITHUB_OUTPUT
          fi
          echo "repo_created=false" >> $GITHUB_OUTPUT

      - name: Set license holder
        id: set-license
        run: |
          if [ -z "${{ inputs.license_holder }}" ]; then
            echo "holder=${{ github.repository_owner }}" >> $GITHUB_OUTPUT
          else
            echo "holder=${{ inputs.license_holder }}" >> $GITHUB_OUTPUT
          fi

      - name: Validate bootstrap inputs
        id: validate-inputs
        shell: bash
        env:
          LANGUAGES: ${{ inputs.languages }}
          ENV_MANAGER: ${{ inputs.env_manager }}
          PYTHON_VERSION: ${{ inputs.python_version }}
          NODE_VERSION: ${{ inputs.node_version }}
          GO_VERSION: ${{ inputs.go_version }}
          JAVA_VERSION: ${{ inputs.java_version }}
        run: |
          if ! [[ "$ENV_MANAGER" =~ ^(micromamba|mise|system)$ ]]; then
            echo "::error::Invalid env_manager '$ENV_MANAGER'. Allowed: micromamba, mise, system"
            exit 1
          fi

          if ! [[ "$LANGUAGES" =~ ^[a-zA-Z0-9,_-]+$ ]]; then
            echo "::error::Invalid languages input '$LANGUAGES'. Use comma-separated language identifiers."
            exit 1
          fi

          ERR_FILE=$(mktemp)
          REPO_ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
          BOOTSTRAP_INPUTS_PATH="$REPO_ROOT/tools/cmd/bootstrap-inputs"
          if ! NORMALIZED_JSON=$(go run "$BOOTSTRAP_INPUTS_PATH" \
            --mode validate \
            --languages "$LANGUAGES" \
            --python-version "$PYTHON_VERSION" \
            --node-version "$NODE_VERSION" \
            --go-version "$GO_VERSION" \
            --java-version "$JAVA_VERSION" 2>"$ERR_FILE"); then
            if [ -s "$ERR_FILE" ]; then
              LAST_LINE=$(tail -n 1 "$ERR_FILE")
              ERROR_MESSAGE=$(printf '%s' "$LAST_LINE" | jq -r '.message // empty' 2>/dev/null || true)
              if [ -n "$ERROR_MESSAGE" ]; then
                echo "::error::$ERROR_MESSAGE"
              else
                echo "::error::bootstrap input validation failed"
                echo "::error::Raw bootstrap-inputs output follows"
                while IFS= read -r line; do
                  echo "::error::$line"
                done < "$ERR_FILE"
              fi
            else
              echo "::error::bootstrap input validation failed"
            fi
            rm -f "$ERR_FILE"
            exit 1
          fi
          rm -f "$ERR_FILE"

          NORMALIZED_LANGUAGES=$(echo "$NORMALIZED_JSON" | jq -r '.languages | join(",")')
          ROOT_LANGUAGE=$(echo "$NORMALIZED_JSON" | jq -r '.root_language')
          RELEASE_TYPE=$(echo "$NORMALIZED_JSON" | jq -r '.release_type')
          CODEQL_LANGUAGES=$(echo "$NORMALIZED_JSON" | jq -r '(.codeql_languages // []) | join(",")')

          echo "languages=$LANGUAGES" >> "$GITHUB_OUTPUT"
          echo "normalized_languages=$NORMALIZED_LANGUAGES" >> "$GITHUB_OUTPUT"
          echo "root_language=$ROOT_LANGUAGE" >> "$GITHUB_OUTPUT"
          echo "release_type=$RELEASE_TYPE" >> "$GITHUB_OUTPUT"
          echo "codeql_languages=$CODEQL_LANGUAGES" >> "$GITHUB_OUTPUT"
          echo "env_manager=$ENV_MANAGER" >> "$GITHUB_OUTPUT"
          echo "python_version=$PYTHON_VERSION" >> "$GITHUB_OUTPUT"
          echo "node_version=$NODE_VERSION" >> "$GITHUB_OUTPUT"
          echo "go_version=$GO_VERSION" >> "$GITHUB_OUTPUT"
          echo "java_version=$JAVA_VERSION" >> "$GITHUB_OUTPUT"

      - name: Validate target owner
        uses: ./.github/actions/validate-bootstrap-owner
        with:
          owner: ${{ steps.set-owner.outputs.owner }}
          allowed_repo_owners: ${{ inputs.allowed_repo_owners }}

      - name: Resolve GitHub token
        id: resolve-token
        uses: ./.github/actions/resolve-gh-token
        with:
          gh_token: ${{ inputs.gh_token }}
          gh_pat_secret: ${{ secrets.GH_PAT }}
          app_id: ${{ inputs.app_id }}
          app_private_key: ${{ secrets.app_private_key || secrets.BOOTSTRAP_APP_PRIVATE_KEY }}
          app_owner: ${{ inputs.app_owner || steps.set-owner.outputs.owner }}

      - name: Audit bootstrap request
        uses: ./.github/actions/audit-bootstrap-request
        with:
          owner: ${{ steps.set-owner.outputs.owner }}
          repo_name: ${{ inputs.repo_name }}
          auth_mode: ${{ steps.resolve-token.outputs.auth_mode }}
          gh_token: ${{ steps.resolve-token.outputs.token }}

      - name: Create new repository
        id: create-repo
        env:
          GH_TOKEN: ${{ steps.resolve-token.outputs.token }}
        run: |
          OWNER="${{ steps.set-owner.outputs.owner }}"
          VISIBILITY="${{ inputs.visibility }}"

          # Determine if creating under user or organization
          if [ "$OWNER" = "${{ github.repository_owner }}" ]; then
            # Check if it's a user or organization
            ORG_TYPE=$(gh api /users/$OWNER --jq '.type')
            if [ "$ORG_TYPE" = "Organization" ]; then
              ENDPOINT="/orgs/$OWNER/repos"
            else
              ENDPOINT="/user/repos"
            fi
          else
            # Assume organization if owner is specified
            ENDPOINT="/orgs/$OWNER/repos"
          fi

          # Create repository with appropriate visibility
          REPO_NAME="${{ inputs.repo_name }}"
          REPO_DESC="${{ inputs.repo_description }}"

          if [ "$ENDPOINT" = "/user/repos" ]; then
            # User repos: use 'private' field (boolean)
            if [ "$VISIBILITY" = "public" ]; then
              PRIVATE_VALUE=false
            else
              PRIVATE_VALUE=true
            fi

            # Use jq to safely encode all string fields — prevents JSON injection
            jq -n \
              --arg name "$REPO_NAME" \
              --arg description "$REPO_DESC" \
              --argjson private "$PRIVATE_VALUE" \
              '{"name":$name,"description":$description,"private":$private,"has_issues":true,"has_projects":true,"has_wiki":false,"auto_init":true}' | \
            gh api \
              --method POST \
              -H "Accept: application/vnd.github+json" \
              "$ENDPOINT" \
              --input -
          else
            # Organization repos: use 'visibility' field (public/private/internal)
            jq -n \
              --arg name "$REPO_NAME" \
              --arg description "$REPO_DESC" \
              --arg visibility "$VISIBILITY" \
              '{"name":$name,"description":$description,"visibility":$visibility,"has_issues":true,"has_projects":true,"has_wiki":false,"auto_init":true}' | \
            gh api \
              --method POST \
              -H "Accept: application/vnd.github+json" \
              "$ENDPOINT" \
              --input -
          fi
          echo "repo_created=true" >> $GITHUB_OUTPUT

      - name: Wait for repository initialization
        run: sleep 5

      - name: Clone new repository
        env:
          GH_TOKEN: ${{ steps.resolve-token.outputs.token }}
        run: |
          git clone https://x-access-token:${GH_TOKEN}@${GH_HOST}/${{ steps.set-owner.outputs.owner }}/${{ inputs.repo_name }}.git new-repo
          cd new-repo
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Copy template files
        run: |
          # Copy all template files and directories
          cp -r templates/* new-repo/
          cp -r templates/.github new-repo/
          cp -r templates/.cursor new-repo/
          cp -r templates/.claude new-repo/

          # Remove template-only helper trees that should not ship in generated repositories.
          rm -rf new-repo/languages new-repo/providers new-repo/.github/workflows/providers

          # Copy root-level dotfiles
          cp templates/.gitignore new-repo/
          cp templates/.gitattributes new-repo/
          cp templates/.commitlintrc.yml new-repo/
          cp templates/.release-please-manifest.json new-repo/
          cp templates/.coderabbit.yaml new-repo/
          cp templates/.prettierrc.yaml new-repo/
          cp templates/.prettierignore new-repo/
          cp templates/.windsurfrules new-repo/

          # Copy release-tool specific dotfiles / directories
          cp templates/.releaserc.json new-repo/

          # Copy .editorconfig from linters to root for IDE integration
          cp templates/.github/linters/.editorconfig new-repo/

      - name: Configure release tool
        run: |
          cd new-repo
          RELEASE_TOOL="${{ inputs.release_tool }}"

          # Files (use rm -f) separated by release tool
          RP_FILES="release-please-config.json .release-please-manifest.json .github/workflows/release-please.yml"
          GC_FILES="cliff.toml .github/workflows/git-cliff-release.yml"
          SR_FILES=".releaserc.json .github/workflows/semantic-release.yml"

          case "$RELEASE_TOOL" in
            "release-please")
              rm -f $GC_FILES $SR_FILES
              echo "Release tool: **release-please** — PR-based semantic versioning (language-aware, ~7k ⭐)" >> $GITHUB_STEP_SUMMARY
              ;;
            "semantic-release")
              rm -f $RP_FILES $GC_FILES
              echo "Release tool: **semantic-release** — push-to-main, fully automated versioning (any language, ~23k ⭐)" >> $GITHUB_STEP_SUMMARY
              ;;
            *)
              # Default: git-cliff
              rm -f $RP_FILES $SR_FILES
              echo "Release tool: **git-cliff** — tag-triggered changelog + GitHub Release (any language, ~9k ⭐)" >> $GITHUB_STEP_SUMMARY
              ;;
          esac

      - name: Remove unselected workflows
        run: |
          cd new-repo
          WORKFLOWS_INPUT="${{ inputs.workflows }}"

          case "$WORKFLOWS_INPUT" in
            "all"|"")
              echo "Keeping all workflows" >> $GITHUB_STEP_SUMMARY
              exit 0
              ;;
          esac

          # Build a space-separated list of workflow filenames to keep
          KEEP_FILES=""
          RELEASE_KEPT=false

          case "$WORKFLOWS_INPUT" in
            "none") ;;
            *)
              IFS=',' read -ra WORKFLOW_NAMES <<< "$WORKFLOWS_INPUT"
              for name in "${WORKFLOW_NAMES[@]}"; do
                name=$(echo "$name" | xargs)
                case "$name" in
                  "lint")           KEEP_FILES="$KEEP_FILES lint.yml" ;;
                  "codeql")         KEEP_FILES="$KEEP_FILES codeql.yml" ;;
                  "ai-code-review") KEEP_FILES="$KEEP_FILES ai-code-review.yml" ;;
                  "release")
                    RELEASE_KEPT=true
                    case "${{ inputs.release_tool }}" in
                      "release-please")   KEEP_FILES="$KEEP_FILES release-please.yml" ;;
                      "semantic-release") KEEP_FILES="$KEEP_FILES semantic-release.yml" ;;
                      *)                  KEEP_FILES="$KEEP_FILES git-cliff-release.yml" ;;
                    esac
                    ;;
                  *)
                    echo "⚠️ Unknown workflow name: '$name' (valid: lint, codeql, ai-code-review, release)" >> $GITHUB_STEP_SUMMARY
                    ;;
                esac
              done
              # Fail fast if every supplied name was unrecognised
              if [ -z "$KEEP_FILES" ]; then
                echo "❌ No valid workflow names found in '$WORKFLOWS_INPUT'. Valid: lint,codeql,ai-code-review,release" >&2
                exit 1
              fi
              ;;
          esac

          # Delete any workflow file not in the keep list
          for file in .github/workflows/*.yml; do
            filename=$(basename "$file")
            [[ " $KEEP_FILES " == *" $filename "* ]] && continue
            rm -f "$file"
            echo "⏭️ Skipped workflow: $filename" >> $GITHUB_STEP_SUMMARY
          done

          # If the release workflow was not kept, also remove its config files
          if [ "$RELEASE_KEPT" = "false" ]; then
            case "${{ inputs.release_tool }}" in
              "release-please")
                rm -f release-please-config.json .release-please-manifest.json
                echo "⏭️ Removed release-please config files" >> $GITHUB_STEP_SUMMARY
                ;;
              "semantic-release")
                rm -f .releaserc.json
                echo "⏭️ Removed semantic-release config file" >> $GITHUB_STEP_SUMMARY
                ;;
              *)
                rm -f cliff.toml
                echo "⏭️ Removed git-cliff config file" >> $GITHUB_STEP_SUMMARY
                ;;
            esac
          fi

      - name: Configure CODEOWNERS
        run: |
          cd new-repo
          case "${{ inputs.enable_codeowners }}" in
            "true")
              sed -i "s/team-leads/${{ inputs.team_name }}/g" .github/CODEOWNERS
              ;;
            *)
              rm -f .github/CODEOWNERS
              echo "⏭️ CODEOWNERS skipped" >> $GITHUB_STEP_SUMMARY
              ;;
          esac

      - name: Update LICENSE with current year and holder
        run: |
          cd new-repo
          CURRENT_YEAR=$(date +%Y)
          sed -i "s/\[year\]/$CURRENT_YEAR/g" LICENSE
          sed -i "s/\[fullname\]/${{ steps.set-license.outputs.holder }}/g" LICENSE

      - name: Update README with repository details
        run: |
          cd new-repo
          sed -i "s/{{REPOSITORY_OWNER}}/${{ steps.set-owner.outputs.owner }}/g" README.md
          sed -i "s/{{REPOSITORY_NAME}}/${{ inputs.repo_name }}/g" README.md

      - name: Log language tooling selection
        run: |
          ROOT_LANGUAGE="${{ steps.validate-inputs.outputs.root_language }}"
          RAW_LANGUAGES="${{ steps.validate-inputs.outputs.languages }}"
          ENV_MANAGER="${{ steps.validate-inputs.outputs.env_manager }}"
          if echo "$RAW_LANGUAGES" | grep -q ','; then
            echo "⚠️ Multiple languages provided ($RAW_LANGUAGES). Tooling template uses first language policy: $ROOT_LANGUAGE" >> "$GITHUB_STEP_SUMMARY"
          fi
          echo "Using language template: $ROOT_LANGUAGE" >> "$GITHUB_STEP_SUMMARY"
          echo "Using environment manager: $ENV_MANAGER" >> "$GITHUB_STEP_SUMMARY"

      - name: Render pre-commit configs
        uses: ./.github/actions/render-precommit-configs
        with:
          root_language: ${{ steps.validate-inputs.outputs.root_language }}
          languages: ${{ steps.validate-inputs.outputs.normalized_languages }}

      - name: Configure provider tooling files
        uses: ./.github/actions/configure-provider-tooling-files
        with:
          root_language: ${{ steps.validate-inputs.outputs.root_language }}
          env_manager: ${{ steps.validate-inputs.outputs.env_manager }}
          repo_name: ${{ inputs.repo_name }}
          python_version: ${{ steps.validate-inputs.outputs.python_version }}
          node_version: ${{ steps.validate-inputs.outputs.node_version }}
          go_version: ${{ steps.validate-inputs.outputs.go_version }}
          java_version: ${{ steps.validate-inputs.outputs.java_version }}

      - name: Configure Release Please for selected languages
        uses: ./.github/actions/configure-release-tool
        with:
          release_tool: ${{ inputs.release_tool }}
          release_type: ${{ steps.validate-inputs.outputs.release_type }}

      - name: Configure CodeQL for selected languages
        uses: ./.github/actions/configure-codeql
        with:
          codeql_input_languages: ${{ steps.validate-inputs.outputs.codeql_languages }}

      - name: Commit and push files
        id: push-files
        run: |
          cd new-repo
          git add .
          git commit -m "chore: initialize repository from bootstrap template"
          git push
          echo "✅ Template files pushed" >> $GITHUB_STEP_SUMMARY

      - name: Apply repository settings
        uses: ./.github/actions/apply-repo-settings
        with:
          owner: ${{ steps.set-owner.outputs.owner }}
          repo_name: ${{ inputs.repo_name }}
          enable_repo_settings: ${{ inputs.enable_repo_settings }}
          gh_token: ${{ steps.resolve-token.outputs.token }}

      - name: Apply repository ruleset
        uses: ./.github/actions/apply-repository-ruleset
        with:
          owner: ${{ steps.set-owner.outputs.owner }}
          repo_name: ${{ inputs.repo_name }}
          gh_token: ${{ steps.resolve-token.outputs.token }}

      - name: Summary
        run: |
          echo "✅ Repository created successfully!" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Repository:** https://github.com/${{ steps.set-owner.outputs.owner }}/${{ inputs.repo_name }}" >> $GITHUB_STEP_SUMMARY
          echo "**Visibility:** ${{ inputs.visibility }}" >> $GITHUB_STEP_SUMMARY
          echo "**Languages:** ${{ steps.validate-inputs.outputs.languages }}" >> $GITHUB_STEP_SUMMARY
          echo "**Environment manager:** ${{ steps.validate-inputs.outputs.env_manager }}" >> $GITHUB_STEP_SUMMARY
          echo "**Runtime versions:** python=${{ steps.validate-inputs.outputs.python_version }}, node=${{ steps.validate-inputs.outputs.node_version }}, go=${{ steps.validate-inputs.outputs.go_version }}, java=${{ steps.validate-inputs.outputs.java_version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Release tool:** ${{ inputs.release_tool || 'git-cliff' }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Created Resources" >> $GITHUB_STEP_SUMMARY

          case "${{ inputs.enable_codeowners }}" in
            "true") echo "- ✅ CODEOWNERS" >> $GITHUB_STEP_SUMMARY ;;
            *)      echo "- ⏭️ CODEOWNERS (skipped)" >> $GITHUB_STEP_SUMMARY ;;
          esac

          case "${{ inputs.enable_repo_settings }}" in
            "true")
              echo "- ✅ Vulnerability alerts and Dependabot security updates enabled" >> $GITHUB_STEP_SUMMARY
              echo "- ✅ Repository ruleset applied (or skipped with warning on unsupported plans)" >> $GITHUB_STEP_SUMMARY
              echo "- ✅ Development environment" >> $GITHUB_STEP_SUMMARY
              echo "- ✅ Production environment" >> $GITHUB_STEP_SUMMARY
              ;;
            *)
              echo "- ⏭️ Vulnerability alerts and Dependabot security updates (skipped; enable_repo_settings=false)" >> $GITHUB_STEP_SUMMARY
              echo "- ✅ Repository ruleset applied (or skipped with warning on unsupported plans)" >> $GITHUB_STEP_SUMMARY
              echo "- ⏭️ Development environment (skipped; enable_repo_settings=false)" >> $GITHUB_STEP_SUMMARY
              echo "- ⏭️ Production environment (skipped; enable_repo_settings=false)" >> $GITHUB_STEP_SUMMARY
              ;;
          esac

          echo "- ✅ Dependabot configuration" >> $GITHUB_STEP_SUMMARY

          echo "- ✅ .editorconfig (4 spaces code, 2 spaces config)" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ .gitignore, .gitattributes" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Documentation templates" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ SECURITY.md (security policy)" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ CONTRIBUTING.md (contribution guide)" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ LICENSE (MIT)" >> $GITHUB_STEP_SUMMARY
          if [ -f new-repo/environment.yml ]; then
            echo "- ✅ provider/micromamba config selected (environment.yml)" >> $GITHUB_STEP_SUMMARY
          elif [ -f new-repo/mise.toml ]; then
            echo "- ✅ provider/mise config selected (mise.toml)" >> $GITHUB_STEP_SUMMARY
          else
            echo "- ✅ provider/system config selected (Makefile only)" >> $GITHUB_STEP_SUMMARY
          fi
          echo "- ✅ .pre-commit-config.yaml (all language: system hooks)" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Conventional commits (pre-commit)" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Makefile (run 'make lint' locally)" >> $GITHUB_STEP_SUMMARY

          case "${{ inputs.workflows }}" in
            "all"|"")
              echo "- ✅ Lint workflow (${{ steps.validate-inputs.outputs.env_manager }} + pre-commit)" >> $GITHUB_STEP_SUMMARY
              case "${{ inputs.release_tool }}" in
                "release-please")
                  echo "- ✅ Release Please workflow (PR-based semantic versioning)" >> $GITHUB_STEP_SUMMARY
                  ;;
                "semantic-release")
                  echo "- ✅ semantic-release workflow (push-to-main, fully automated)" >> $GITHUB_STEP_SUMMARY
                  echo "- ✅ .releaserc.json (semantic-release configuration)" >> $GITHUB_STEP_SUMMARY
                  ;;
                *)
                  echo "- ✅ git-cliff release workflow (tag-based changelog + GitHub Release)" >> $GITHUB_STEP_SUMMARY
                  echo "- ✅ cliff.toml (changelog configuration)" >> $GITHUB_STEP_SUMMARY
                  ;;
              esac
              ;;
            "none")
              echo "- ⏭️ All workflows skipped" >> $GITHUB_STEP_SUMMARY
              ;;
            *)
              echo "- ✅ Selected workflows: ${{ inputs.workflows }}" >> $GITHUB_STEP_SUMMARY
              ;;
          esac

  cleanup-approval:
    name: Await Cleanup Approval
    runs-on: ubuntu-latest
    needs: create-repository
    if: >-
      always() &&
      needs.create-repository.outputs.repo_created == 'true' &&
      needs.create-repository.result == 'failure' &&
      inputs.cleanup_on_failure == true &&
      inputs.require_cleanup_approval == true
    permissions: {}
    # Create this environment in repository settings and add required reviewers
    # to enforce manual approval for destructive cleanup.
    environment: bootstrap-cleanup
    steps:
      - name: Await approval
        run: echo "Cleanup approval granted."

  teardown-with-approval:
    name: Cleanup Repository (Approved)
    runs-on: ubuntu-latest
    needs:
      - create-repository
      - cleanup-approval
    env:
      GH_HOST: ${{ inputs.github_host || 'github.com' }}
    # Only cleanup if repo was created AND (creation failed AND cleanup is enabled)
    if: >-
      always() &&
      needs.create-repository.outputs.repo_created == 'true' &&
      needs.create-repository.result == 'failure' &&
      inputs.cleanup_on_failure == true &&
      inputs.require_cleanup_approval == true &&
      needs.cleanup-approval.result == 'success'
    permissions:
      contents: read

    steps:
      - name: Resolve bootstrap repository
        id: bootstrap-repo
        shell: bash
        run: |
          REPO=$(printf '%s' '${{ github.workflow_ref }}' | cut -d'/' -f1,2)
          echo "repository=$REPO" >> "$GITHUB_OUTPUT"

      - name: Checkout bootstrap repository
        uses: actions/checkout@v7
        with:
          repository: ${{ steps.bootstrap-repo.outputs.repository }}
          ref: ${{ github.workflow_sha }}

      - name: Resolve GitHub token
        id: resolve-token
        uses: ./.github/actions/resolve-gh-token
        with:
          gh_token: ${{ inputs.gh_token }}
          gh_pat_secret: ${{ secrets.GH_PAT }}
          app_id: ${{ inputs.app_id }}
          app_private_key: ${{ secrets.app_private_key || secrets.BOOTSTRAP_APP_PRIVATE_KEY }}
          app_owner: ${{ inputs.app_owner || needs.create-repository.outputs.owner }}

      - name: Delete repository on failure
        env:
          GH_TOKEN: ${{ steps.resolve-token.outputs.token }}
        run: |
          OWNER="${{ needs.create-repository.outputs.owner }}"
          REPO="${{ inputs.repo_name }}"

          # Check if repository exists before attempting deletion
          if gh repo view "$OWNER/$REPO" &>/dev/null; then
            echo "🗑️ Deleting repository $OWNER/$REPO due to failure..." >> $GITHUB_STEP_SUMMARY

            # Delete the repository
            gh api \
              --method DELETE \
              -H "Accept: application/vnd.github+json" \
              /repos/$OWNER/$REPO

            echo "✅ Repository deleted successfully" >> $GITHUB_STEP_SUMMARY
          else
            echo "ℹ️ Repository does not exist, nothing to clean up" >> $GITHUB_STEP_SUMMARY
          fi

  teardown-no-approval:
    name: Cleanup Repository (No Approval)
    runs-on: ubuntu-latest
    needs: create-repository
    env:
      GH_HOST: ${{ inputs.github_host || 'github.com' }}
    if: >-
      always() &&
      needs.create-repository.outputs.repo_created == 'true' &&
      needs.create-repository.result == 'failure' &&
      inputs.cleanup_on_failure == true &&
      inputs.require_cleanup_approval == false
    permissions:
      contents: read

    steps:
      - name: Resolve bootstrap repository
        id: bootstrap-repo
        shell: bash
        run: |
          REPO=$(printf '%s' '${{ github.workflow_ref }}' | cut -d'/' -f1,2)
          echo "repository=$REPO" >> "$GITHUB_OUTPUT"

      - name: Checkout bootstrap repository
        uses: actions/checkout@v7
        with:
          repository: ${{ steps.bootstrap-repo.outputs.repository }}
          ref: ${{ github.workflow_sha }}

      - name: Resolve GitHub token
        id: resolve-token
        uses: ./.github/actions/resolve-gh-token
        with:
          gh_token: ${{ inputs.gh_token }}
          gh_pat_secret: ${{ secrets.GH_PAT }}
          app_id: ${{ inputs.app_id }}
          app_private_key: ${{ secrets.app_private_key || secrets.BOOTSTRAP_APP_PRIVATE_KEY }}
          app_owner: ${{ inputs.app_owner || needs.create-repository.outputs.owner }}

      - name: Delete repository on failure
        env:
          GH_TOKEN: ${{ steps.resolve-token.outputs.token }}
        run: |
          OWNER="${{ needs.create-repository.outputs.owner }}"
          REPO="${{ inputs.repo_name }}"

          # Check if repository exists before attempting deletion
          if gh repo view "$OWNER/$REPO" &>/dev/null; then
            echo "🗑️ Deleting repository $OWNER/$REPO due to failure..." >> $GITHUB_STEP_SUMMARY

            # Delete the repository
            gh api \
              --method DELETE \
              -H "Accept: application/vnd.github+json" \
              /repos/$OWNER/$REPO

            echo "✅ Repository deleted successfully" >> $GITHUB_STEP_SUMMARY
          else
            echo "ℹ️ Repository does not exist, nothing to clean up" >> $GITHUB_STEP_SUMMARY
          fi