@theholocron/cli 2.0.0-alpha.13 → 2.0.0-alpha.15

package/dist/cli.mjs

@@ -1085,6 +1085,13 @@ on: # yamllint disable-line rule:truthy
         type: boolean
         required: false
         default: true
+    secrets:
+      SYNC_TOKEN:
+        description: >
+          Optional PAT with Contents write access. Required when the default
+          branch is protected by a ruleset — github.token cannot push through
+          rulesets, but a PAT with admin bypass can. Falls back to github.token.
+        required: false
 
 jobs:
   release:
@@ -1124,7 +1131,11 @@ jobs:
       - run: npx semantic-release
         name: Release
         env:
-          GITHUB_TOKEN: \${{ github.token }}
+          # Prefer SYNC_TOKEN (a PAT with Contents write) when available —
+          # the built-in github.token cannot push to protected default branches
+          # because rulesets block non-PAT pushes. Falls back to github.token
+          # for repos without branch protection.
+          GITHUB_TOKEN: \${{ secrets.SYNC_TOKEN || github.token }}
           NPM_CONFIG_PROVENANCE: true
 `,
 	review: `\
@@ -1361,8 +1372,10 @@ name: Sync GitHub Templates
 # template source files change on main or alpha.
 #
 # Secrets required:
-#   SYNC_TOKEN — fine-grained PAT or GitHub App token with Contents write
-#                access to the primary and secondary repos.
+#   SYNC_TOKEN — fine-grained PAT (resource owner: org) with:
+#                  Contents:      Read and write  (git trees, blobs, refs)
+#                  Pull requests: Read and write  (open sync PR)
+#                  Workflows:     Read and write  (write .github/workflows/*.yml)
 
 on: # yamllint disable-line rule:truthy
   workflow_call:
@@ -1982,14 +1995,25 @@ async function runSyncGithub(input) {
 		};
 	}
 	const { sha: newCommitSha } = await newCommitRes.json();
-	const refUpdateRes = createPr && branch ? await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify({
-			ref: `refs/heads/${branch}`,
-			sha: newCommitSha
-		})
-	}) : await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs/heads/${targetBranch}`, {
+	let refUpdateRes;
+	if (createPr && branch) {
+		refUpdateRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs`, {
+			method: "POST",
+			headers,
+			body: JSON.stringify({
+				ref: `refs/heads/${branch}`,
+				sha: newCommitSha
+			})
+		});
+		if (refUpdateRes.status === 422) refUpdateRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs/heads/${branch}`, {
+			method: "PATCH",
+			headers,
+			body: JSON.stringify({
+				sha: newCommitSha,
+				force: true
+			})
+		});
+	} else refUpdateRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs/heads/${targetBranch}`, {
 		method: "PATCH",
 		headers,
 		body: JSON.stringify({ sha: newCommitSha })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.0-alpha.13",
+  "version": "2.0.0-alpha.15",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",