From f4cb8d6381ff89c35affdac663e48803ffd7d793 Mon Sep 17 00:00:00 2001 From: Markus Waldheim Date: Mon, 10 Aug 2026 10:32:51 +0200 Subject: [PATCH 1/3] fix(sync): cover the complete plugin matrix Include publisher, packager, and newer condition, hook, and updater repositories in continuous standard reconciliation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Markus Waldheim --- .github/workflows/sync-template.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-template.yml b/.github/workflows/sync-template.yml index 9bd0d33..f5f4fc6 100644 --- a/.github/workflows/sync-template.yml +++ b/.github/workflows/sync-template.yml @@ -69,7 +69,7 @@ jobs: fail-fast: false max-parallel: 8 matrix: - plugin: ${{ fromJSON(needs.discover.outputs.plugins) }} +plugin: ${{ fromJSON(needs.discover.outputs.plugins) }} steps: - name: Check out template From bc17800643ff58b37e423293591b824d9ec39ba1 Mon Sep 17 00:00:00 2001 From: Markus Waldheim Date: Mon, 10 Aug 2026 10:38:10 +0200 Subject: [PATCH 2/3] feat(sync): discover plugins from the organization Build the sync matrix from active SemRels repositories using the established plugin category prefixes so new plugins are included automatically. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Markus Waldheim --- .github/workflows/sync-template.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-template.yml b/.github/workflows/sync-template.yml index f5f4fc6..9bd0d33 100644 --- a/.github/workflows/sync-template.yml +++ b/.github/workflows/sync-template.yml @@ -69,7 +69,7 @@ jobs: fail-fast: false max-parallel: 8 matrix: -plugin: ${{ fromJSON(needs.discover.outputs.plugins) }} + plugin: ${{ fromJSON(needs.discover.outputs.plugins) }} steps: - name: Check out template From c5d4c15ec564ba18d5fe3af661230190844f298f Mon Sep 17 00:00:00 2001 From: Markus Waldheim Date: Mon, 24 Aug 2026 11:23:33 +0200 Subject: [PATCH 3/3] fix(sync): avoid workflow pushes by default Workflow files require the workflow token scope and cannot be updated by a least-privileged sync token. Keep push and schedule syncs limited to non-workflow files; retain explicit workflow_dispatch opt-in for authorized tokens.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/sync-template.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/sync-template.yml b/.github/workflows/sync-template.yml index 9bd0d33..54889c5 100644 --- a/.github/workflows/sync-template.yml +++ b/.github/workflows/sync-template.yml @@ -11,10 +11,6 @@ on: - GOVERNANCE.md - SECURITY.md - MAINTAINERS.md - - .github/workflows/ci.yml - - .github/workflows/release.yml - - .github/workflows/security.yml - - .github/workflows/sync-template.yml schedule: - cron: "17 3 * * *" workflow_dispatch: @@ -87,7 +83,10 @@ jobs: - name: Apply template files env: PLUGIN: ${{ matrix.plugin }} - INCLUDE_WORKFLOWS: ${{ github.event_name == 'push' || github.event_name == 'schedule' || inputs.include_workflows }} + # Workflow files require the repository's SYNC_TOKEN to have the + # GitHub Actions workflow scope. Never include them in unattended + # push/schedule syncs, which use the least-privileged token. + INCLUDE_WORKFLOWS: ${{ github.event_name == 'workflow_dispatch' && inputs.include_workflows || 'false' }} shell: bash run: | set -euo pipefail