fix(sync): pin the signed-commits engine; record the grants decision

[kyle-sexton]

Summary

Two consequences of the pilot's merge attempt:

• Pin bump to 7c29641 (ci-workflows#60): the pilot sync PR (github-iac#37) was green on every check but unmergeable — every constellation repo enforces required_signatures, and the engine's CLI-created commits were unsigned. The engine now creates commits via the API (sign-commits: true), signed by GitHub as the sync App's bot. After this merges, a re-run refreshes the pilot PR with a signed commit.
• Grants decision recorded (plan doc, Auth): AppInstallationRepository is unusable under github-iac's credential model (the grants API rejects App installation tokens; the deploy deliberately stores no PAT). Superseded by "only select repositories" managed in the UI — provider-inexpressible, same class as App registration. github-iac#38 closed with the same rationale; a forgotten grant self-signals as a failed sync leg.

Verification

actionlint + markdownlint (module config) clean locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GbDWhcUtduCejgi7mcbMfy

---

Note

Low Risk
Workflow SHA pin changes how sync commits are created (fixes mergeability); doc-only grant policy clarification with no runtime code in this repo.

Overview
Pins the standards-sync reusable workflow in .github/workflows/sync.yml from 789abbe to 7c29641 so sync PRs use API commits with sign-commits: true, matching constellation repos that require signed commits (pilot PRs were green but unmergeable on unsigned CLI commits).

Updates docs/dedup-program/config-distribution-plan.md Auth and the activation checklist: repo access for the sync App is UI-managed (“only select repositories”), superseding Pulumi AppInstallationRepository (grants API + github-iac’s App-only credential model). Remaining manual steps are called out—narrow org installation, public App, personal-account install.

^{Reviewed by Cursor Bugbot for commit 859d7a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @kyle-sexton's task in 1m 11s —— View job

---

PR Review

• Gather context (CLAUDE.md, REVIEW.md)
• Read PR diff and changed files
• Analyze workflow change (sync.yml)
• Analyze documentation change (config-distribution-plan.md)
• Post review findings

---

Two changes, reviewed separately.

.github/workflows/sync.yml — SHA pin bump

Line 36: 789abbe → 7c29641. The bump follows the existing convention exactly (full 40-char SHA in the uses: line, short-SHA + date comment). Only one token changed; no other inputs, secrets, or structure were touched. Clean and minimal.

No issues here.

docs/dedup-program/config-distribution-plan.md — grants decision record

The Auth section's step 2 is fully replaced with a dated decision record that:

• Names the root cause (AppInstallationRepository rejects App installation tokens) and the constraint that caused it (deploy model carries no PAT)
• Cross-references the closed issue (github-iac#38) as evidence
• States the resulting approach (UI-managed "Only select repositories")
• Classifies it alongside App registration as provider-inexpressible
• Documents the failure mode: "A forgotten grant is self-signaling: that target's sync leg fails to mint a token"

That failure-mode line is genuinely useful — it turns a possible silent footgun into a known-loud error, which is worth documenting.

The activation checklist update is consistent: the old "Pulumi-managed per-repo grants" sub-task is replaced with three discrete manual UI steps (flip to select repos, make App public, personal-account install).

One minor observation: The checklist adds "make the App public" without a corresponding explanation in the Auth section body. A reader following the Auth section for rationale won't find why the App needs to be public (the answer is that cross-account installs require it — a GitHub App must be public to be installable on accounts other than the owning org). The cross-account caveat below step 2 covers the what (install on both accounts) but not the why public is required. This is low-severity documentation gap — the checklist item is correct, the constraint is real, it just isn't explained inline.

Fix this →

No correctness or security issues. The SHA bump solves the described problem (unsigned CLI commits blocked by required_signatures) in the minimal way possible, and the documentation accurately captures the architectural decision with enough rationale to reconstruct the reasoning later.

Verdict: ready to merge, pending the one optional doc clarification above.

[cursor]

Risk: low. Cursor Bugbot completed with no findings; approving this workflow pin bump and documentation update.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}