[valuecodes]

What

• Brings in the template's (agentic-monorepo-starter) changes since the last sync (48c1ee4..d232d8a). The checks now live once in a reusable checks.yml, called by feature.yml on PRs and main.yml on push to main. all-passed keeps its name, so the ruleset needs no change.
• Adds a workflow-lint job (actionlint + zizmor) and moves valuecodes/automation to v0.4.0, one release past the template's v0.3.1. The new release adds a supply-chain section and alerts to the dashboard, and shows its state in the issue title. CodeQL drops the actions language, since workflow-lint covers the workflow files.
• Removes node-update.yml. The maintenance dashboard now flags Node.js security releases right away, so a Node bump is done by hand from the dashboard.
• Adds .githooks/. pre-commit runs format:check, lint and secrets:scan --staged; pre-push runs typecheck, test and knip. They are enabled by the root prepare script on pnpm install. The Docker gitleaks fallback forwards GIT_INDEX_FILE, and .claude/settings.json denies --no-verify.

After merging

• Run pnpm install once in your checkout to turn the hooks on.
• Run Maintenance dashboard by hand once, to check the v0.4.0 issue format.
• Optional: turn off Actions → General → Allow GitHub Actions to create and approve pull requests, since nothing uses it now. The old CodeQL /language:actions alerts stop updating.

How to test

pnpm install
git config --get core.hooksPath
pnpm format:check
pnpm lint
pnpm knip
pnpm typecheck
pnpm test
pnpm build
pnpm secrets:scan --staged

Security review

• The workflows keep permissions: {} at the top. Each caller job grants only what checks.yml asks for (actions: read, contents: read, security-events: write).
• The reusable workflows are pinned to commit SHA c207ce5 (v0.4.0) and need only contents: read (workflow-lint) or contents: read + issues: write (dashboard).
• zizmor run locally over .github/: no findings.
• The pre-commit secrets scan fails closed when neither gitleaks nor Docker is available.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T07:58:47.080775Z	31e158f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.