docs(hooks): Publish standalone GitHub Actions catalog

[mathemage]

Summary

• make README.md a concise landing page and list.md the canonical 30-recipe catalog
• add 30 copy-ready C#/.NET GitHub Actions workflow files with explicit integration contracts
• harden permissions, callbacks, review/deployment flows, merge-queue parity, and AI secret boundaries

Why

Colleagues need a standalone catalog they can copy selectively without enabling all examples or inheriting undocumented repository assumptions.

Impact

Each recipe is classified as copy, replacement, paired integration, or project-specific scaffold. Required branches, labels, variables, secrets, environments, and external payloads are documented before adoption.

Validation

• actionlint 1.7.12 across all 30 workflows
• ShellCheck 0.11.0 through actionlint
• Ruby YAML parse for all 30 files
• local Markdown link and 1:1 catalog coverage checks
• immutable action SHA/tag verification through the GitHub API
• staged whitespace and diff checks

Closes #1

[Copilot]

Pull request overview

This pull request turns the repository into a standalone, copy-ready catalog of GitHub Actions workflow “hooks” for C#/.NET projects, with a concise landing page (README.md) and a canonical indexed catalog (list.md) pointing at 30 example workflows stored under workflows/ (so they don’t execute in this repo by default).

Changes:

• Replaces the minimal README with an adoption-focused landing page and security boundary guidance.
• Adds list.md as the navigable index + integration-contract reference for the 30 recipes.
• Adds 30 workflow YAML examples (01–30), including CI, deployment governance, and AI/agent-related patterns with explicit privilege boundaries.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	New landing page explaining how to browse/adopt recipes and outlining baseline assumptions & security boundaries.
list.md	Canonical catalog index of all 30 workflows, including “Copy/Replace/Pair/Scaffold” guidance and common setup.
workflows/01-pull-request-validation.yml	Baseline PR CI (format/build/test/coverage) + dependency review.
workflows/02-main-push-verification.yml	Post-merge verification on main.
workflows/03-merge-queue-validation.yml	Merge Queue–compatible CI variant.
workflows/04-manual-run.yml	Controlled workflow_dispatch CI run with allow-listed options.
workflows/05-reusable-workflow.yml	Reusable .NET validation workflow via workflow_call.
workflows/06-scheduled-audit.yml	Nightly tests + vulnerable package inventory.
workflows/07-release-published.yml	Build/test/pack on release publication; retains artifacts.
workflows/08-workflow-run-chain.yml	Chains a trusted workflow_run into a repository_dispatch.
workflows/09-external-dispatch.yml	Validates and re-checks an externally reported commit via repository_dispatch.
workflows/10-deployment-request.yml	Policy gate for deployment requests (env, SHA, change ticket).
workflows/11-deployment-status.yml	Post-deployment smoke tests with allow-listed environment URL host checks.
workflows/12-review-decision.yml	Automation enforcing two current write-authorized approvals.
workflows/13-inline-review-command.yml	Inline review comment ChatOps to retest contract suite.
workflows/14-issue-comment-chatops.yml	Authorized /deploy staging ChatOps that verifies required checks before creating a Deployment.
workflows/15-issue-lifecycle.yml	Security-incident issue lifecycle checklist + summary logging.
workflows/16-protection-rule-drift.yml	Opens governance issue on branch protection edits/deletes.
workflows/17-package-publication.yml	Rebuild/test on package publish; preserves dependency evidence.
workflows/18-reference-lifecycle.yml	Audits create/delete refs + verifies signed annotated release tags.
workflows/19-pr-target-metadata.yml	pull_request_target labeling by path without checkout.
workflows/20-ai-assisted-pr-gate.yml	Additional CI gate when ai-assisted label is present.
workflows/21-ai-instruction-governance.yml	Governs AI instruction files via CODEOWNERS tail rules + credential scanning.
workflows/22-agent-environment-validation.yml	Validates Copilot coding agent setup steps and deterministic .NET inputs.
workflows/23-evaluation-corpus-validation.yml	Base-commit evaluator/corpus comparison against candidate changes (project scaffold).
workflows/24-agent-task-intake.yml	Validates ai-task issue intake format and allowed paths before labeling ai-ready.
workflows/25-authorized-ai-command.yml	Authorized /ai-review command to run a trusted, bounded AI reviewer over PR diff data.
workflows/26-human-agent-remediation.yml	Dispatches remediation identifiers on changes_requested review (pair with a consumer).
workflows/27-manual-ai-regression.yml	Manual AI regression runner (project scaffold) gated to default branch + environment.
workflows/28-nightly-ai-regression.yml	Scheduled AI regression runner (project scaffold) with retained artifacts.
workflows/29-agent-completed-callback.yml	External agent callback validation + immutable merge-result CI.
workflows/30-agent-ci-privilege-separation.yml	Privileged follow-up after unprivileged agent CI using workflow_run metadata only.

Comments suppressed due to low confidence (1)

workflows/23-evaluation-corpus-validation.yml:70

• The evaluator is passed --corpus "$TRUSTED_EVAL_ROOT/evals/corpus", but other AI-eval recipes in this catalog use evals/corpora/.... Consider aligning the directory name here to match the rest of the catalog to avoid inconsistent adoption contracts.

          dotnet run --project "$EVAL_PROJECT" --configuration Release --no-restore -- \
            --candidate-root "$CANDIDATE_ROOT" \
            --corpus "$TRUSTED_EVAL_ROOT/evals/corpus" \
            --baseline "$TRUSTED_EVAL_ROOT/evals/baseline.json" \

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

workflows/30-agent-ci-privilege-separation.yml:10

• This job calls the commits API (/commits/${HEAD_SHA}/pulls), but the workflow token is not granted contents: read. In repositories that use fine-grained workflow permissions, this can yield 403s even though the job never checks out code. Add contents: read to keep the least-privilege intent while ensuring the API call is authorized.
  workflows/10-deployment-request.yml:48
• This status update runs on any prior failure in the job (including a transient failure posting the in_progress status), but the description claims the request "failed policy validation". That message can be inaccurate and misleading for deployment consumers; use a generic failure description (or scope the condition to the validation step specifically).

      - name: Mark rejected request as failed
        if: ${{ failure() }}
        run: |
          gh api --method POST \
            "repos/${GITHUB_REPOSITORY}/deployments/${DEPLOYMENT_ID}/statuses" \
            -f state=error \
            -f description="Deployment request failed policy validation"