Centralized CI CLI: pipeline dispatch, tasks, gh issues, and workflow E2E

.cli/tag.yaml

@@ -0,0 +1,5 @@
+# Tag naming for this repository (read by gardusig-cli `git tag` / `git deploy`).
+# Semver release tags; deploy workflow runs on push to main only.
+pattern: semver-v
+bump: patch
+require_increase: true

.cli/tag.yaml.example

@@ -0,0 +1,13 @@
+# Copy to `<repo>/.cli/tag.yaml` — read by gardusig-cli (`cli git tag`, `cli git deploy`).
+#
+# Patterns:
+#   date      — YYYY-MM-DD snapshot (most gardusig repos)
+#   semver-v  — v1.2.3 (cli / PyPI releases)
+#   semver    — 1.2.3
+#   plain     — explicit tag names only
+#
+# Optional (semver only):
+#   bump: patch | minor | major
+#   require_increase: true
+
+pattern: date

.env.example

@@ -1,9 +1,11 @@
 # Local secrets (copy to .env — never commit .env)
 # NOTION_TOKEN=secret_...
 # NOTION_DATABASE_ID=your-notion-database-id
-# NOTION_TASK_ROOT=~/git-local/private/configured/tasks
+# NOTION_TASK_ROOT=~/git-local/private/private/tasks
+# GH_TOKEN=github_pat_...          # local only; CI uses CENTRAL_PIPELINE_PAT in github-pipelines
 # BACKUP_ZIP_PASSWORD=your-zip-password
 # CLI_CONFIG_DIR=~/.config/cli
+# CLI_GH_ISSUES_DEPLOY_ALLOW=1    # break-glass for non-private test repos only
 #
 # PyPI publish — https://pypi.org/manage/account/token/
 # PYPI_API_TOKEN=pypi-...