feat(sync): activate the push + schedule cascade

[kyle-sexton]

Summary

Stage 2 of the caller activation, now that the pilot is confirmed (melodic-software/github-iac#37 — merged):

• push trigger on main, paths-filtered to the distributed files (modules/**, root hygiene files, stub sources, the manifest) — upstream edits cascade immediately.
• weekly schedule (Mon 06:00 UTC) — drift repair even without upstream pushes.
• Both are real runs (inputs.dry-run || false; inputs is empty on those events). Dispatch keeps its dry-run-default preview + targets allowlist.
• Engine pin bumped to 789abbe (client-id mint, ci-workflows#59); secret flipped to STANDARDS_SYNC_APP_CLIENT_ID in lockstep. STANDARDS_SYNC_APP_ID gets deleted after this merges.
• Plan doc: the ready-to-paste caller snippet is replaced by a pointer to the live workflow (single source, no drift).

Note: until the App is installed on the kyle-sexton account (manual step, in progress), the three personal-account sync legs fail while the org legs succeed (fail-fast: false).

Verification

actionlint + zizmor + markdownlint (module config) clean locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GbDWhcUtduCejgi7mcbMfy

---

Note

Medium Risk
Merging enables real cross-repo PR opens on every qualifying main push and weekly cron; auth secret renames must be in place or sync legs will fail until the App is fully installed on all target accounts.

Overview
Stage 2 activation for Track B config distribution: the standards-sync caller now runs on push to main (path-filtered to distributed files) and on a weekly Monday 06:00 UTC schedule, so upstream edits cascade immediately and drift can be repaired without a push. Manual workflow_dispatch still defaults to dry-run with an optional targets allowlist; push and schedule use inputs.dry-run || false and inputs.targets || '' so those events perform real syncs (not preview-only).

The reusable engine ref is bumped to 789abbe, and caller secrets move from app-id / STANDARDS_SYNC_APP_ID to app-client-id / STANDARDS_SYNC_APP_CLIENT_ID in line with the engine’s client-id minting change.

Docs: config-distribution-plan.md drops the long inline caller YAML snippet and points to .github/workflows/sync.yml as the single source of truth, noting the two-stage activation (dispatch-only pilot, then push + schedule).

^{Reviewed by Cursor Bugbot for commit 3f3b355. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @kyle-sexton's task in 1m 35s —— View job

---

PR Review

• Gather context (CLAUDE.md, REVIEW.md, changed files)
• Review .github/workflows/sync.yml changes
• Review docs/dedup-program/config-distribution-plan.md changes
• Post final review

---

The changes are correct and the activation logic is sound. A few observations:

dry-run expression

sync.yml L42: ${{ inputs.dry-run || false }} is correct — on push/schedule events inputs is an empty context, so the falsy fallback makes both non-dispatch triggers real runs while workflow_dispatch passes through whatever the user chose. The warning comment about the == 'schedule' antipattern is a useful guard for future editors.

Push paths filter scope

sync.yml L9-L15: The filter covers modules/**, the two root stubs (ruff.toml, .gitleaks.toml), the root hygiene files, and the manifest. However, the Layer 2 distributed set in the plan doc also includes pyrightconfig.json, .shellcheckrc, _typos.toml, .editorconfig-checker.json, and PSScriptAnalyzerSettings.psd1. Edits to those files will not trigger an immediate cascade; they rely on the weekly schedule for drift repair. This looks intentional (stubs and module files change more often than the others) but isn't explicitly called out — worth a brief comment if the intent is "stubs + modules cascade immediately; everything else drifts at most one week."

targets fallback

sync.yml L43: ${{ inputs.targets || '' }} is correct — the empty string signals "all targets" to the engine, and on non-dispatch events this is what you want.

Secret rename

app-id → app-client-id / STANDARDS_SYNC_APP_ID → STANDARDS_SYNC_APP_CLIENT_ID is an in-lockstep rename with the engine bump to 789abbe. The PR description notes STANDARDS_SYNC_APP_ID is a manual delete post-merge — worth confirming that's tracked somewhere (e.g. github-iac) so it doesn't get left as an orphan secret.

Engine SHA pin

sync.yml L36: Pin bump from 9cf6d13 → 789abbe with the inline date comment follows the repo's D5 pinning convention. No issues.

Doc update

Replacing the ready-to-paste snippet with a pointer to the live file is the right call — the snippet was already a drift vector the moment it was written.

---

Overall: logic is correct, the || false fallback is applied properly, and the doc cleanup is clean. The only non-trivial note is the narrow paths scope for push — make sure it's a deliberate choice (and if so, a one-line comment would make it obvious to the next reader). Approved subject to that clarification.

[cursor]

Risk: medium. Cursor Bugbot completed successfully with no findings requiring human review. Approved; no reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}