@theholocron/cli 3.31.1 → 3.33.0

package/dist/capabilities/index.d.mts

@@ -366,6 +366,12 @@ interface Deployment extends ProviderIdentity {
     target?: DeploymentTrigger;
   }): Promise<DeploymentRecord>;
   getDeployment(deploymentId: string): Promise<DeploymentRecord>;
+  /**
+   * Add a custom domain (or wildcard) to the project. Idempotent — no-op
+   * when the domain is already present. Optional: providers without a custom
+   * domain API omit this (e.g. Vercel manages domains separately).
+   */
+  ensureCustomDomain?(projectId: string, hostname: string): Promise<void>;
 }
 interface StorageBranch {
   id: string;

package/dist/cli.mjs

@@ -2830,21 +2830,120 @@ function generateThinCallerContent(name, withOverrides, additionalPaths) {
 	return injected;
 }
 /**
+* Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
+*
+* Accepts three forms:
+* - `preview: true` — derive both project and domain from org context
+* - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
+* - `preview: { project: "...", domain: "..." }` — fully explicit
+*
+* Returns null when `preview:` is absent, false, or can't be resolved.
+*/
+function extractPreviewConfig(raw, ctx = {}) {
+	const preview = raw["preview"];
+	if (!preview) return null;
+	if (preview === true) {
+		const project = ctx.org ? `${ctx.org}-preview` : null;
+		const domain = ctx.domain ? `preview.${ctx.domain}` : void 0;
+		if (!project) return null;
+		return {
+			project,
+			...domain ? { domain } : {}
+		};
+	}
+	if (typeof preview !== "object") return null;
+	const p = preview;
+	const project = typeof p["project"] === "string" && p["project"] ? p["project"] : ctx.org ? `${ctx.org}-preview` : null;
+	if (!project) return null;
+	const domain = typeof p["domain"] === "string" && p["domain"] ? p["domain"] : ctx.domain ? `preview.${ctx.domain}` : void 0;
+	return {
+		project,
+		...domain ? { domain } : {}
+	};
+}
+/**
+* Generate the full thin-caller YAML for a `deploy.yml` that handles both
+* production (push to main → GitHub Pages) and preview (pull_request →
+* Cloudflare Pages) in a single file.
+*
+* Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
+* config supplies `cloudflare-project` it is forwarded; otherwise the reusable
+* falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
+* all repos with a `deploy` workflow get previews without per-repo config.
+*/
+function generateCombinedDeployContent(deployWith, paths, preview) {
+	const yamlScalar = (v) => {
+		if (v === true) return "true";
+		if (v === false) return "false";
+		const s = String(v);
+		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
+	};
+	const withLines = (entries) => Object.entries(entries).map(([k, v]) => `      ${k}: ${yamlScalar(v)}`).join("\n");
+	const pathsBlock = paths.length > 0 ? `    paths:\n${paths.map((p) => `      - ${p}\n`).join("")}` : "";
+	const previewWith = {
+		...deployWith,
+		"cloudflare-project": preview.project
+	};
+	const deployWithBlock = Object.keys(deployWith).length > 0 ? `    with:\n${withLines(deployWith)}\n` : "";
+	const previewWithBlock = `    with:\n${withLines(previewWith)}\n`;
+	return [
+		`name: Deploy`,
+		``,
+		`on: # yamllint disable-line rule:truthy`,
+		`  push:`,
+		`    branches: [main]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  pull_request:`,
+		`    branches: [main]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  workflow_dispatch:`,
+		``,
+		`concurrency:`,
+		`  group: $\{{ github.event_name == 'pull_request' && format('deploy-preview-{0}', github.event.pull_request.number) || 'pages' }}`,
+		`  cancel-in-progress: $\{{ github.event_name == 'pull_request' }}`,
+		``,
+		`permissions:`,
+		`  contents: read`,
+		`  pages: write`,
+		`  id-token: write`,
+		`  pull-requests: write`,
+		``,
+		`jobs:`,
+		`  deploy:`,
+		`    name: Deploy`,
+		`    if: \${{ github.event_name != 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/deploy.yml@main`,
+		...deployWithBlock ? [deployWithBlock.trimEnd()] : [],
+		`    secrets: inherit`,
+		``,
+		`  preview:`,
+		`    name: Deploy Preview`,
+		`    if: \${{ github.event_name == 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/deploy-preview.yml@main`,
+		previewWithBlock.trimEnd(),
+		`    secrets: inherit`,
+		``
+	].join("\n");
+}
+/**
 * Expand structured with-values to flat GitHub Actions inputs before
 * generating the thin caller. Handles:
 *   - deploy shorthand: docs/storybook → type + storybook-projects
+*   - preview: stripped (handled separately via extractPreviewConfig)
 *   - run-chromatic object → run-chromatic: true + chromatic-projects
 *   - plain arrays → JSON-stringified for YAML scalar quoting
 *
 * Used by both `holocron setup` and `sync-workflow-templates`.
 */
-function normalizeWorkflowWith(raw) {
+function normalizeWorkflowWith(raw, repoName) {
 	const result = { ...raw };
+	delete result["preview"];
 	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
 	const storybookProjects = raw["storybook"];
 	if (hasDocs) {
 		result["type"] = "docs";
 		delete result["docs"];
+		if (!result["name"] && repoName) result["name"] = repoName;
 	}
 	if (Array.isArray(storybookProjects)) {
 		if (!hasDocs) result["type"] = "storybook";
@@ -3390,7 +3489,7 @@ async function runSetup(input) {
 		for (const entry of workflows) {
 			const name = typeof entry === "string" ? entry : entry.name;
 			const rawWith = typeof entry === "object" ? entry.with : void 0;
-			const withOverrides = rawWith ? normalizeWorkflowWith(rawWith) : void 0;
+			const withOverrides = rawWith ? normalizeWorkflowWith(rawWith, config.name) : void 0;
 			const additionalPaths = (typeof entry === "object" ? entry.paths : void 0) ?? (name === "deploy" && rawWith ? deriveDeployPaths(rawWith) : void 0);
 			if (name === "test" && withOverrides) {
 				const runUnit = withOverrides["run-unit"];
@@ -3407,6 +3506,20 @@ async function runSetup(input) {
 				print(formatStep(steps[steps.length - 1]));
 				continue;
 			}
+			if (name === "deploy" && rawWith) {
+				const previewCfg = extractPreviewConfig(rawWith, {
+					org: config.org,
+					domain: config.domain
+				});
+				if (previewCfg) {
+					const paths = additionalPaths;
+					steps.push(await runStep("source", "write workflow deploy (with preview)", dryRun, async () => {
+						await source.writeWorkflowFile("deploy.yml", workflowHeader() + generateCombinedDeployContent(withOverrides, paths, previewCfg));
+					}));
+					print(formatStep(steps[steps.length - 1]));
+					continue;
+				}
+			}
 			steps.push(await runStep("source", `write workflow ${name}`, dryRun, async () => {
 				await source.writeWorkflowFile(`${name}.yml`, workflowHeader() + generateThinCallerContent(name, withOverrides, additionalPaths));
 			}));
@@ -3578,6 +3691,28 @@ async function runSetup(input) {
 			await deploy.ensureProject({ name: config.name });
 		}));
 		print(formatStep(steps[steps.length - 1]));
+		const deployEntry = (config.workflows ?? []).map((e) => typeof e === "string" ? { name: e } : e).find((e) => e.name === "deploy");
+		const previewCfg = deployEntry?.with ? extractPreviewConfig(deployEntry.with) : null;
+		if (previewCfg?.domain && deploy.ensureCustomDomain) {
+			const wildcardDomain = `*.${previewCfg.domain}`;
+			steps.push(await runStep("deployment", `ensureCustomDomain ${wildcardDomain}`, dryRun, async () => {
+				await deploy.ensureCustomDomain(previewCfg.project, wildcardDomain);
+			}));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		if (previewCfg?.domain && loader.has("dns")) {
+			const dns = loader.get("dns");
+			const wildcardDomain = `*.${previewCfg.domain}`;
+			steps.push(await runStep("dns", `upsertRecord ${wildcardDomain}`, dryRun, async () => {
+				await dns.upsertRecord(previewCfg.domain, {
+					type: "CNAME",
+					name: wildcardDomain,
+					content: `${previewCfg.project}.pages.dev`,
+					ttl: 1
+				});
+			}));
+			print(formatStep(steps[steps.length - 1]));
+		}
 	}
 	if (loader.has("auth")) {
 		const auth = loader.get("auth");
@@ -4480,6 +4615,9 @@ var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line ru
 //#region src/templates/workflows/deploy.yml
 var deploy_default = "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
 //#endregion
+//#region src/templates/workflows/deploy-preview.yml
+var deploy_preview_default = "name: Deploy Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Deploy Preview\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1.5.0\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          projectName: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n          directory: _site\n          gitHubToken: ${{ secrets.GITHUB_TOKEN }}\n          # Branch name scoped to repo+PR so the wildcard custom domain\n          # *.preview.theholocron.dev resolves to <repo>-pr-<n>.preview.theholocron.dev\n          branch: ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n";
+//#endregion
 //#region src/templates/workflows/greetings.yml
 var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
 //#endregion
@@ -4537,6 +4675,7 @@ const REUSABLE_WORKFLOWS = {
 	codeql: codeql_default,
 	dependencies: dependencies_default,
 	deploy: deploy_default,
+	"deploy-preview": deploy_preview_default,
 	greetings: greetings_default,
 	lint: lint_default,
 	"post-release": post_release_default,
@@ -4635,6 +4774,20 @@ function parseWorkflowsFromTs(source) {
 	for (const entry of explicitEntries) merged.set(entry.name, entry);
 	return [...merged.values()];
 }
+/**
+* Extract org name and docs domain from a `holocron.config.ts` source string.
+* Used to resolve `preview: true` to `{ project: "<org>-preview", domain: "preview.<docsDomain>" }`.
+*/
+function parseOrgContextFromTs(source) {
+	const orgMatch = source.match(/\borg\s*:\s*["']([^"']+)["']/);
+	const domainMatch = source.match(/\bdomain\s*:\s*["']([^"']+)["']/);
+	const nameMatch = source.split(/\bworkflows\s*:/)[0].match(/\bname\s*:\s*["']([^"']+)["']/);
+	return {
+		org: orgMatch?.[1],
+		domain: domainMatch?.[1],
+		repoName: nameMatch?.[1]
+	};
+}
 function reusableHeader(source) {
 	return [
 		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
@@ -4645,7 +4798,7 @@ function reusableHeader(source) {
 		``
 	].join("\n");
 }
-function buildBatch(repo, allowedWorkflows, withOverrides) {
+function buildBatch(repo, allowedWorkflows, withOverrides, orgContext) {
 	const files = [];
 	const isPrimaryGithubRepo = repo === DEFAULT_REPO;
 	if (isPrimaryGithubRepo) for (const [name, content] of Object.entries(ACTIONS)) files.push({
@@ -4669,9 +4822,22 @@ function buildBatch(repo, allowedWorkflows, withOverrides) {
 			});
 		}
 	} else for (const name of Object.keys(REUSABLE_WORKFLOWS)) {
+		if (name === "deploy-preview") continue;
 		if (allowedWorkflows && !allowedWorkflows.has(name)) continue;
 		const rawWith = withOverrides?.get(name);
-		const content = generateThinCallerContent(name, rawWith ? normalizeWorkflowWith(rawWith) : void 0, name === "deploy" && rawWith ? deriveDeployPaths(rawWith) : void 0);
+		const normalizedWith = rawWith ? normalizeWorkflowWith(rawWith, orgContext?.repoName) : void 0;
+		const additionalPaths = name === "deploy" && rawWith ? deriveDeployPaths(rawWith) : void 0;
+		if (name === "deploy" && rawWith) {
+			const previewCfg = extractPreviewConfig(rawWith, orgContext);
+			if (previewCfg) {
+				files.push({
+					path: `.github/workflows/deploy.yml`,
+					content: workflowHeader() + generateCombinedDeployContent(normalizedWith, additionalPaths, previewCfg)
+				});
+				continue;
+			}
+		}
+		const content = generateThinCallerContent(name, normalizedWith, additionalPaths);
 		if (!content) continue;
 		files.push({
 			path: `.github/workflows/${name}.yml`,
@@ -4751,6 +4917,7 @@ async function runSyncGithub(input) {
 	}
 	let allowedWorkflows;
 	let withOverrides;
+	let orgContext;
 	if (repo !== DEFAULT_REPO) try {
 		let entries = [];
 		try {
@@ -4760,7 +4927,9 @@ async function runSyncGithub(input) {
 			if (!(err instanceof ProviderApiError) || err.status !== 404) throw err;
 			try {
 				const data = await client.git.getContents(repo, "holocron.config.ts");
-				entries = parseWorkflowsFromTs(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"));
+				const source = Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8");
+				entries = parseWorkflowsFromTs(source);
+				orgContext = parseOrgContextFromTs(source);
 			} catch {}
 		}
 		if (entries.length > 0) {
@@ -4769,7 +4938,7 @@ async function runSyncGithub(input) {
 			if (overrideEntries.length > 0) withOverrides = new Map(overrideEntries);
 		}
 	} catch {}
-	const batch = buildBatch(repo, allowedWorkflows, withOverrides);
+	const batch = buildBatch(repo, allowedWorkflows, withOverrides, orgContext);
 	let created = 0;
 	let updated = 0;
 	let unchanged = 0;