From 9d12693cc6f4174e20995bc217bfc383f584c647 Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Thu, 24 Sep 2026 11:10:01 -0300 Subject: [PATCH 1/7] refactor: use checked-out catalog sync action --- workflow-templates/sync-workflow-templates.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml index d7aacf2..311773e 100644 --- a/workflow-templates/sync-workflow-templates.yml +++ b/workflow-templates/sync-workflow-templates.yml @@ -157,7 +157,7 @@ jobs: - name: Synchronize workflow templates id: sync - uses: LibreCodeCoop/.github/actions/sync-workflows@492e6c7c5a9bb7642f39238583003d2cb93f3ba6 # organization helpers + uses: ./source/actions/sync-workflows with: source: source/workflow-templates target: target From 9f42f80edf5cebdb27786008b0cd0fbcf1fa9537 Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Thu, 24 Sep 2026 11:10:26 -0300 Subject: [PATCH 2/7] docs: align repository architecture guidance --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index bfd1c0e..102b2cd 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -13,7 +13,7 @@ This repository is the LibreCode Coop organization configuration repository. It - `governance.config.json` is the declarative source for LibreCodeCoop repository governance and supported GitHub metadata. - The governance engine itself lives in `LibreCodeCoop/github-governance`. -- Reusable workflow/action implementation lives in `LibreCodeCoop/github-workflows`. +- Organization workflow templates and helper Actions live in this repository. Product-specific release behavior belongs in its owning product repository, such as `LibreCodeCoop/release-tool`. - `workflow-templates/**` is the organization catalog consumed by repositories; do not add product-specific business logic here. - Repository-local licenses, README files and `AGENTS.md` stay in their own repositories. From c71e8df5346dd80948b4d222354973daad0098ff Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Thu, 24 Sep 2026 11:10:29 -0300 Subject: [PATCH 3/7] docs: describe current upstream refresh policy --- docs/upstream-workflows.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docs/upstream-workflows.md b/docs/upstream-workflows.md index ac22c42..64d3f7a 100644 --- a/docs/upstream-workflows.md +++ b/docs/upstream-workflows.md @@ -74,7 +74,6 @@ also visible in Actions. Failures while resolving, downloading or verifying upstream sources are treated as fatal and do not create a partial update pull request. -A dedicated `WORKFLOW_UPDATE_TOKEN` secret is required for pull-request creation. -Using only the workflow's `GITHUB_TOKEN` would prevent the resulting pull request -from triggering the normal CI workflows. The refresh itself uses the read-only -`GITHUB_TOKEN` to resolve public upstream commits. +Pull-request creation uses a short-lived installation token from the `LibreCode Workflow Automation` GitHub App. Using only the workflow's `GITHUB_TOKEN` would prevent the resulting pull request from triggering the normal CI workflows. The refresh itself uses the read-only `GITHUB_TOKEN` only to resolve public upstream commits. + +Action pins in rendered templates are intentionally preserved from the current LibreCode template when the same Action still exists upstream. Dependency version updates are owned by Dependabot in this repository, while the upstream refresh imports structural workflow changes. This keeps upstream tracking and dependency updates independently reviewable. From 91ee33986343460f74ee133056acd71abe0e361a Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Thu, 24 Sep 2026 11:10:32 -0300 Subject: [PATCH 4/7] refactor: remove retired workflow sync identifier --- scripts/sync_upstream.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/sync_upstream.py b/scripts/sync_upstream.py index 18f8c6f..2379c33 100644 --- a/scripts/sync_upstream.py +++ b/scripts/sync_upstream.py @@ -151,7 +151,7 @@ def _latest_commit(repository: str, ref: str, path: str, token: str | None) -> s ) headers = { "Accept": "application/vnd.github+json", - "User-Agent": "github-workflows-sync", + "User-Agent": "librecode-workflow-catalog-sync", "X-GitHub-Api-Version": "2022-11-28", } if token: @@ -174,7 +174,7 @@ def _latest_commit(repository: str, ref: str, path: str, token: str | None) -> s def _download(url: str) -> bytes: - request = Request(url, headers={"User-Agent": "github-workflows-sync"}) + request = Request(url, headers={"User-Agent": "librecode-workflow-catalog-sync"}) with urlopen(request, timeout=30) as response: return response.read() From 4077fb4922633ea7e67f7c31d968217a687b9dcf Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Thu, 24 Sep 2026 11:11:11 -0300 Subject: [PATCH 5/7] test: derive local sync action from downstream patch --- patches/nextcloud/sync-workflow-templates.yml.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch index 487db50..35e5b30 100644 --- a/patches/nextcloud/sync-workflow-templates.yml.patch +++ b/patches/nextcloud/sync-workflow-templates.yml.patch @@ -212,7 +212,7 @@ - echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV + - name: Synchronize workflow templates + id: sync -+ uses: LibreCodeCoop/.github/actions/sync-workflows@492e6c7c5a9bb7642f39238583003d2cb93f3ba6 # organization helpers ++ uses: ./source/actions/sync-workflows + with: + source: source/workflow-templates + target: target From 1a1d00015f035ea7d3da435e567cf35243941ec7 Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Thu, 24 Sep 2026 11:13:06 -0300 Subject: [PATCH 6/7] docs: define multi-branch consumer policy --- docs/cross-repository-automation.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/cross-repository-automation.md b/docs/cross-repository-automation.md index bd6fe49..0b6842e 100644 --- a/docs/cross-repository-automation.md +++ b/docs/cross-repository-automation.md @@ -44,6 +44,8 @@ After installation, the updater runs weekly and can also be dispatched manually. Consumer-specific changes belong in `.github/workflows/.patch`. Do not edit a managed workflow directly when the difference should survive synchronization. +The catalog updater targets only the consumer's default branch by default. Projects with maintained long-lived release branches should declare those branches through a consumer-local patch to `sync-workflow-templates.yml`; branch lifecycle is consumer policy and must not be hard-coded in the organization template. + ## Publishing templates `LibreCodeCoop/.github` is the source of truth for LibreCode-managed workflow templates and the distribution catalog consumed by repository updaters. Templates derived from external upstream sources are refreshed through the pinned upstream/patch pipeline rather than edited as independent downstream implementations. From c2d4cccf7c0018492f4a8cbdc5300cd6264c216a Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Thu, 24 Sep 2026 11:13:47 -0300 Subject: [PATCH 7/7] docs: use actual upstream refresh workflow name --- docs/upstream-workflows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/upstream-workflows.md b/docs/upstream-workflows.md index 64d3f7a..f0b7d7c 100644 --- a/docs/upstream-workflows.md +++ b/docs/upstream-workflows.md @@ -56,7 +56,7 @@ the renderer returns a structured report containing every failure. ## Automated refresh -The scheduled `refresh-upstream.yml` workflow: +The scheduled `upstream-refresh.yml` workflow: 1. resolves each tracked upstream workflow to its latest commit; 2. updates the immutable URL, SHA-256 and vendored bytes;