[castastrophe]

What

Run the template sync with the org GitHub App (allons-y-studio-bot) instead of the PAT_GITHUB secret.

Why

Weaver opens PRs in other repositories. The app token starts CI on them & drops a personal token.

How

• First job step creates an app token from APP_CLIENT_ID & APP_PRIVATE_KEY with owner set to the org, so it covers every repository the app is installed on, not only this one.
• Checkout & actions-weaver use it.
• Templates are README blocks only, so no workflow files are changed in other repositories; the app has no workflows permission.

Test plan

Run "Sync templates" manually (workflow_dispatch) after merge:

1. The sync PRs in other repositories are opened by allons-y-studio-bot[bot].
2. CI runs on them.
3. Check that the app is installed on every repository Weaver targets.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a5e1c01

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR