devkit-sync.yml

# devkit-sync — caller template (SPEC DEC-044).
#
# Copied into a consumer plugin repo at .github/workflows/devkit-sync.yml by
# `make link-workflows`. Bumps the repo's vendored devkit submodule
# (tests/_testkit) to the devkit's latest release within its major channel.
#
# ON DEMAND ONLY (DEC-079). This used to run nightly at 04:00 UTC. A submodule
# pin is a deliberate dependency upgrade, not something that should happen while
# you sleep, and the schedule cost more than it delivered:
#   * 189 runs across the fleet produced 29 merged bumps — 51 PRs opened, 18 of
#     them closed without ever merging.
#   * From 2026-07-10 it silently no-op'd for three weeks: every night it opened
#     a PR whose checks sat in `action_required` awaiting approval, so nothing
#     merged and nothing complained. A no-op looks exactly like "nothing to sync".
#   * It clobbered in-flight work — see the branch-delete note in the reusable
#     workflow.
# Bump deliberately instead: `make update-devkit`, or run this workflow manually.
#
# Required REPO-level secrets (the shared sync GitHub App; already present on
# repos that previously used skills-sync — same App):
#   SKILLS_SYNC_APP_CLIENT_ID    — App OAuth Client ID (Iv23li…)
#   SKILLS_SYNC_APP_PRIVATE_KEY  — App private-key PEM
# The App must be installed (Contents:Read) on the devkit repo. It does NOT
# need to be installed on this consumer — GITHUB_TOKEN covers the local push/PR.
#
# DO NOT add pull_request: triggers — fork-PR is the secret-exfiltration vector.
name: devkit-sync

on:
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  sync:
    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@v2.1.6
    with:
      devkit-submodule-path: "tests/_testkit"
    secrets:
      SKILLS_SYNC_APP_CLIENT_ID: ${{ secrets.SKILLS_SYNC_APP_CLIENT_ID }}
      SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }}