refactor: simplify workflow catalog synchronization

AGENTS.md

@@ -13,7 +13,7 @@ This repository is the LibreCode Coop organization configuration repository. It
 
 - `governance.config.json` is the declarative source for LibreCodeCoop repository governance and supported GitHub metadata.
 - The governance engine itself lives in `LibreCodeCoop/github-governance`.
-- Reusable workflow/action implementation lives in `LibreCodeCoop/github-workflows`.
+- Organization workflow templates and helper Actions live in this repository. Product-specific release behavior belongs in its owning product repository, such as `LibreCodeCoop/release-tool`.
 - `workflow-templates/**` is the organization catalog consumed by repositories; do not add product-specific business logic here.
 - Repository-local licenses, README files and `AGENTS.md` stay in their own repositories.
 

docs/cross-repository-automation.md

@@ -44,6 +44,8 @@ After installation, the updater runs weekly and can also be dispatched manually.
 
 Consumer-specific changes belong in `.github/workflows/<workflow>.patch`. Do not edit a managed workflow directly when the difference should survive synchronization.
 
+The catalog updater targets only the consumer's default branch by default. Projects with maintained long-lived release branches should declare those branches through a consumer-local patch to `sync-workflow-templates.yml`; branch lifecycle is consumer policy and must not be hard-coded in the organization template.
+
 ## Publishing templates
 
 `LibreCodeCoop/.github` is the source of truth for LibreCode-managed workflow templates and the distribution catalog consumed by repository updaters. Templates derived from external upstream sources are refreshed through the pinned upstream/patch pipeline rather than edited as independent downstream implementations.

docs/upstream-workflows.md

@@ -56,7 +56,7 @@ the renderer returns a structured report containing every failure.
 
 ## Automated refresh
 
-The scheduled `refresh-upstream.yml` workflow:
+The scheduled `upstream-refresh.yml` workflow:
 
 1. resolves each tracked upstream workflow to its latest commit;
 2. updates the immutable URL, SHA-256 and vendored bytes;
@@ -74,7 +74,6 @@ also visible in Actions.
 Failures while resolving, downloading or verifying upstream sources are treated
 as fatal and do not create a partial update pull request.
 
-A dedicated `WORKFLOW_UPDATE_TOKEN` secret is required for pull-request creation.
-Using only the workflow's `GITHUB_TOKEN` would prevent the resulting pull request
-from triggering the normal CI workflows. The refresh itself uses the read-only
-`GITHUB_TOKEN` to resolve public upstream commits.
+Pull-request creation uses a short-lived installation token from the `LibreCode Workflow Automation` GitHub App. Using only the workflow's `GITHUB_TOKEN` would prevent the resulting pull request from triggering the normal CI workflows. The refresh itself uses the read-only `GITHUB_TOKEN` only to resolve public upstream commits.
+
+Action pins in rendered templates are intentionally preserved from the current LibreCode template when the same Action still exists upstream. Dependency version updates are owned by Dependabot in this repository, while the upstream refresh imports structural workflow changes. This keeps upstream tracking and dependency updates independently reviewable.

patches/nextcloud/sync-workflow-templates.yml.patch

@@ -212,7 +212,7 @@
 -          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 +      - name: Synchronize workflow templates
 +        id: sync
-+        uses: LibreCodeCoop/.github/actions/sync-workflows@492e6c7c5a9bb7642f39238583003d2cb93f3ba6 # organization helpers
++        uses: ./source/actions/sync-workflows
 +        with:
 +          source: source/workflow-templates
 +          target: target

scripts/sync_upstream.py

@@ -151,7 +151,7 @@ def _latest_commit(repository: str, ref: str, path: str, token: str | None) -> s
     )
     headers = {
         "Accept": "application/vnd.github+json",
-        "User-Agent": "github-workflows-sync",
+        "User-Agent": "librecode-workflow-catalog-sync",
         "X-GitHub-Api-Version": "2022-11-28",
     }
     if token:
@@ -174,7 +174,7 @@ def _latest_commit(repository: str, ref: str, path: str, token: str | None) -> s
 
 
 def _download(url: str) -> bytes:
-    request = Request(url, headers={"User-Agent": "github-workflows-sync"})
+    request = Request(url, headers={"User-Agent": "librecode-workflow-catalog-sync"})
     with urlopen(request, timeout=30) as response:
         return response.read()
 

workflow-templates/sync-workflow-templates.yml

@@ -157,7 +157,7 @@ jobs:
 
       - name: Synchronize workflow templates
         id: sync
-        uses: LibreCodeCoop/.github/actions/sync-workflows@492e6c7c5a9bb7642f39238583003d2cb93f3ba6 # organization helpers
+        uses: ./source/actions/sync-workflows
         with:
           source: source/workflow-templates
           target: target