@theholocron/cli 2.0.0-alpha.8 → 2.0.0-alpha.9

package/dist/cli.mjs

@@ -1130,6 +1130,78 @@ jobs:
         name: Upload results to Codecov
         with:
           token: \${{ secrets.CODECOV_TOKEN }}
+`,
+	"sync-github": `\
+name: Sync GitHub Templates
+
+# Builds the holocron CLI from source and pushes updated workflow templates
+# and composite actions to downstream .github repos. Runs whenever the
+# template source files change on main or alpha.
+#
+# Secrets required:
+#   SYNC_TOKEN — fine-grained PAT or GitHub App token with Contents write
+#                access to the primary and secondary repos.
+
+on: # yamllint disable-line rule:truthy
+  workflow_call:
+    inputs:
+      primary-repo:
+        description: >
+          Primary .github repo — receives composite actions, reusable workflows,
+          and thin-caller templates. Requires a PR (branch protection assumed).
+        type: string
+        required: false
+        default: theholocron/.github
+      secondary-repos:
+        description: >
+          Space-separated list of secondary repos (reusable workflows + thin
+          callers only, no composite actions). Pushed directly to main.
+        type: string
+        required: false
+        default: ""
+      sync-branch:
+        description: Branch name used for the primary-repo PR
+        type: string
+        required: false
+        default: chore/sync-templates
+    secrets:
+      SYNC_TOKEN:
+        required: true
+
+jobs:
+  sync:
+    name: Sync templates
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        name: Checkout repository
+
+      - uses: theholocron/.github/.github/actions/setup@main
+        name: Setup
+
+      - run: pnpm build
+        name: Build CLI
+
+      - name: Sync primary repo (PR)
+        run: >
+          node packages/cli/dist/cli.mjs sync-github
+          --repo \${{ inputs.primary-repo }}
+          --branch \${{ inputs.sync-branch }}
+          --pr
+        env:
+          GITHUB_TOKEN: \${{ secrets.SYNC_TOKEN }}
+
+      - name: Sync secondary repos (direct push)
+        if: \${{ inputs.secondary-repos != '' }}
+        run: |
+          for repo in \${{ inputs.secondary-repos }}; do
+            node packages/cli/dist/cli.mjs sync-github --repo "$repo"
+          done
+        env:
+          GITHUB_TOKEN: \${{ secrets.SYNC_TOKEN }}
 `,
 	typecheck: `\
 name: Typecheck
@@ -1393,6 +1465,32 @@ jobs:
   audit:
     uses: ${ref("audit")}
     secrets: inherit
+`,
+	"sync-github": `\
+name: Sync GitHub Templates
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches: [main, alpha]
+    paths:
+      - packages/cli/src/templates/index.ts
+      - packages/cli/src/commands/setup-workflows.ts
+
+concurrency:
+  group: sync-github-\${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    name: Sync
+    uses: ${ref("sync-github")}
+    with:
+      secondary-repos: theholocron/.github-private
+    secrets:
+      SYNC_TOKEN: \${{ secrets.SYNC_TOKEN }}
 `
 };
 const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
@@ -1420,9 +1518,9 @@ function thinCallerHeader() {
 		``
 	].join("\n");
 }
-function buildBatch() {
+function buildBatch(repo) {
 	const files = [];
-	for (const [name, content] of Object.entries(ACTIONS)) files.push({
+	if (repo === DEFAULT_REPO) for (const [name, content] of Object.entries(ACTIONS)) files.push({
 		path: `.github/actions/${name}.yml`,
 		content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
 	});
@@ -1440,7 +1538,7 @@ async function runSyncGithub(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const repo = input.repo ?? DEFAULT_REPO;
 	const [owner, repoName] = repo.split("/");
-	const { token, dryRun = false } = input;
+	const { token, dryRun = false, branch, createPr = false } = input;
 	const message = input.message ?? `chore: sync from theholocron/holocron`;
 	const fetchFn = input.fetch ?? globalThis.fetch;
 	const headers = {
@@ -1450,19 +1548,21 @@ async function runSyncGithub(input) {
 		"X-GitHub-Api-Version": "2022-11-28"
 	};
 	print(`holocron sync-github${dryRun ? " (dry-run)" : ""}`);
-	print(`  repo: ${repo}`);
+	print(`  repo:   ${repo}`);
+	if (branch) print(`  branch: ${branch}`);
 	print("");
-	const batch = buildBatch();
+	const batch = buildBatch(repo);
 	let created = 0;
 	let updated = 0;
 	let unchanged = 0;
 	for (const file of batch) {
+		const ref = branch ? `?ref=${encodeURIComponent(branch)}` : "";
 		const url = `${API_BASE}/repos/${owner}/${repoName}/contents/${file.path}`;
 		const newContent = Buffer.from(file.content, "utf8").toString("base64");
 		let existingSha;
 		let existingContent;
 		try {
-			const getRes = await fetchFn(url, { headers });
+			const getRes = await fetchFn(`${url}${ref}`, { headers });
 			if (getRes.ok) {
 				const data = await getRes.json();
 				existingSha = data.sha;
@@ -1486,6 +1586,7 @@ async function runSyncGithub(input) {
 			content: newContent
 		};
 		if (existingSha) body.sha = existingSha;
+		if (branch) body.branch = branch;
 		const putRes = await fetchFn(url, {
 			method: "PUT",
 			headers,
@@ -1507,13 +1608,36 @@ async function runSyncGithub(input) {
 		if (existingSha) updated++;
 		else created++;
 	}
+	const changed = created + updated;
 	print("");
 	print(`  ${created} created, ${updated} updated, ${unchanged} unchanged`);
+	let prUrl;
+	if (branch && createPr && changed > 0 && !dryRun) {
+		const prRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/pulls`, {
+			method: "POST",
+			headers,
+			body: JSON.stringify({
+				title: message,
+				head: branch,
+				base: "main",
+				body: "Auto-generated by `holocron sync-github`. Review and merge to apply template updates."
+			})
+		});
+		if (prRes.ok) {
+			prUrl = (await prRes.json()).html_url;
+			print(`  → PR opened: ${prUrl}`);
+		} else {
+			const err = await prRes.json();
+			if (err.errors?.some((e) => e.message.includes("already exists"))) print(`  → PR already open for ${branch} — branch updated, ready to merge`);
+			else print(`  ⚠ PR creation failed: ${err.message ?? prRes.status}`);
+		}
+	}
 	return {
 		status: dryRun ? "dry-run" : "ok",
 		created,
 		updated,
-		unchanged
+		unchanged,
+		prUrl
 	};
 }
 //#endregion
@@ -3493,6 +3617,13 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	type: "string",
 	default: "theholocron/.github",
 	describe: "Target org/repo (default: theholocron/.github)"
+}).option("branch", {
+	type: "string",
+	describe: "Push to this branch instead of the default branch (enables PR-based workflow for protected repos)"
+}).option("pr", {
+	type: "boolean",
+	default: false,
+	describe: "Open a PR after pushing to --branch (no-op without --branch)"
 }).option("message", {
 	type: "string",
 	describe: "Commit message (default: chore: sync from theholocron/holocron)"
@@ -3507,6 +3638,8 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		token,
 		repo: argv.repo,
 		dryRun: argv.dryRun,
+		...argv.branch ? { branch: argv.branch } : {},
+		...argv.pr ? { createPr: true } : {},
 		...argv.message ? { message: argv.message } : {}
 	})).status === "fail") process.exitCode = 1;
 }).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.0-alpha.8",
+  "version": "2.0.0-alpha.9",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",