@theholocron/cli 3.37.0 → 3.37.2

package/dist/cli.mjs

@@ -3059,7 +3059,7 @@ function generateCombinedDeployContent(deployWith, paths, preview) {
 *
 * Used by both `holocron setup` and `sync-workflow-templates`.
 */
-function normalizeWorkflowWith(raw, repoName) {
+function normalizeWorkflowWith(raw) {
 	const result = { ...raw };
 	delete result["preview"];
 	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
@@ -3067,7 +3067,6 @@ function normalizeWorkflowWith(raw, repoName) {
 	if (hasDocs) {
 		result["type"] = "docs";
 		delete result["docs"];
-		if (!result["name"] && repoName) result["name"] = repoName;
 	}
 	if (Array.isArray(storybookProjects)) {
 		if (!hasDocs) result["type"] = "storybook";
@@ -3613,7 +3612,7 @@ async function runSetup(input) {
 		for (const entry of workflows) {
 			const name = typeof entry === "string" ? entry : entry.name;
 			const rawWith = typeof entry === "object" ? entry.with : void 0;
-			const withOverrides = rawWith ? normalizeWorkflowWith(rawWith, config.name) : void 0;
+			const withOverrides = rawWith ? normalizeWorkflowWith(rawWith) : void 0;
 			const additionalPaths = (typeof entry === "object" ? entry.paths : void 0) ?? (name === "deploy" && rawWith ? deriveDeployPaths(rawWith) : void 0);
 			if (name === "test" && withOverrides) {
 				const runUnit = withOverrides["run-unit"];
@@ -4437,7 +4436,7 @@ async function runSync(input) {
 	else try {
 		await loader.load();
 	} catch (err) {
-		if (!(err instanceof AuthError)) throw err;
+		if (!(err instanceof AuthError) && !(err instanceof LoaderError)) throw err;
 	}
 	print(`Holocron sync — ${config.name}${dryRun ? " (dry-run)" : ""}`);
 	print(`  config: ${input.loaded.filepath}`);
@@ -4659,7 +4658,7 @@ async function runSync(input) {
 			} else for (const entry of workflowEntries) {
 				const name = typeof entry === "string" ? entry : entry.name;
 				const rawWith = typeof entry === "object" ? entry.with : void 0;
-				const withOverrides = rawWith ? normalizeWorkflowWith(rawWith, config.name) : void 0;
+				const withOverrides = rawWith ? normalizeWorkflowWith(rawWith) : void 0;
 				const additionalPaths = (typeof entry === "object" ? entry.paths : void 0) ?? (name === "deploy" && rawWith ? deriveDeployPaths(rawWith) : void 0);
 				if (!KNOWN_WORKFLOWS.has(name)) {
 					steps.push({
@@ -4813,7 +4812,7 @@ var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n
 var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
 //#endregion
 //#region src/templates/workflows/deploy.yml
-var deploy_default = "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
+var deploy_default = "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
 //#endregion
 //#region src/templates/workflows/deploy-preview.yml
 var deploy_preview_default = "name: Deploy Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Deploy Preview\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            if [ -n \"$SITE_NAME\" ]; then\n              # Site built with base: /<name>/ — nest under _site/<name>/ so asset\n              # paths match (/name/_astro/... → served at /name/_astro/...).\n              mkdir -p \"_site/${SITE_NAME}\"\n              cp -r docs/dist/. \"_site/${SITE_NAME}/\"\n              # Redirect root to the base path so the preview URL lands correctly.\n              printf \"/ /%s/ 301\\n\" \"$SITE_NAME\" > _site/_redirects\n            else\n              cp -r docs/dist/. _site/\n            fi\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - name: Install Wrangler\n        # The action's install step runs npm/pnpm in the repo root; pnpm fails\n        # because it rejects adding to a workspace root without -w, and npm fails\n        # because package.json contains pnpm catalog: references it cannot parse.\n        # Pre-installing from /tmp (no package.json) lets the action find wrangler\n        # already on PATH and skip its own install entirely.\n        working-directory: /tmp\n        run: npm install -g wrangler@4\n\n      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0\n        id: deploy\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          packageManager: npm\n          command: >-\n            pages deploy _site\n            --project-name ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n            --branch ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n            --commit-dirty=true\n\n      - name: Report preview URL\n        if: ${{ steps.deploy.outputs.pages-deployment-alias-url != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          ALIAS: ${{ steps.deploy.outputs.pages-deployment-alias-url }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n        run: |\n          PREVIEW_URL=\"${ALIAS%/}${SITE_NAME:+/${SITE_NAME}}/\"\n          # GITHUB_HEAD_REF is the PR branch name — links the deployment to this PR's sidebar widget.\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"%s\",\"description\":\"Cloudflare Pages\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\" \"${PROJECT} (Preview)\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"${PREVIEW_URL}\"\n";
@@ -4840,7 +4839,7 @@ var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  w
 var sync_default = "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme description\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Sync repo from config\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync\n        run: |\n          if [ -n \"$STEPS\" ]; then\n            # shellcheck disable=SC2086\n            pnpm exec holocron sync --steps $STEPS\n          else\n            pnpm exec holocron sync\n          fi\n        env:\n          HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n          HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n          HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n          HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n          HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n\n      - name: Format generated files\n        run: pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n";
 //#endregion
 //#region src/templates/workflows/sync-broadcast.yml
-var sync_broadcast_default = "name: Sync Broadcast\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n";
+var sync_broadcast_default = "name: Sync Broadcast\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n";
 //#endregion
 //#region src/templates/workflows/sync-github.yml
 var sync_github_default = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Actions:       Read and write  (dispatch workflow runs via gh workflow run)\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
@@ -5026,7 +5025,7 @@ function buildBatch(repo, allowedWorkflows, withOverrides, orgContext) {
 		if (name === "deploy-preview") continue;
 		if (allowedWorkflows && !allowedWorkflows.has(name)) continue;
 		const rawWith = withOverrides?.get(name);
-		const normalizedWith = rawWith ? normalizeWorkflowWith(rawWith, orgContext?.repoName) : void 0;
+		const normalizedWith = rawWith ? normalizeWorkflowWith(rawWith) : void 0;
 		const additionalPaths = name === "deploy" && rawWith ? deriveDeployPaths(rawWith) : void 0;
 		if (name === "deploy" && rawWith) {
 			const previewCfg = extractPreviewConfig(rawWith, orgContext);
@@ -6023,10 +6022,10 @@ try {
 			dryRun: argv.dryRun,
 			...argv.otp ? { otp: argv.otp } : {}
 		})).status === "fail") process.exitCode = 1;
-	}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description, homepage, readme)", (y) => y.positional("steps", {
+	}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description, homepage, readme, workflows)", (y) => y.positional("steps", {
 		type: "string",
 		array: true,
-		describe: "Steps to run: labels, properties, topics, keywords, description, homepage, readme (default: all)"
+		describe: "Steps to run: labels, properties, topics, keywords, description, homepage, readme, workflows (default: all)"
 	}).option("repo", {
 		type: "string",
 		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."