refactor: move distributed files to src/, add sync check CI

- Distributed files now live in src/ — consumers use `path: src/`
- Top-level files are identical copies (repo eats its own dog food)
- CI sync-check job validates top-level and src/ stay in sync
- Removed .common-repo.yaml (path: scoping replaces source excludes)
- Updated README with new structure and usage

.common-repo.yaml

@@ -1,7 +0,0 @@
-# Source-level common-repo config
-# Excludes files that are part of this template repo itself,
-# not intended to be distributed to consumers.
-- exclude:
-    - "README.md"
-    - ".common-repo.yaml"
-    - "LICENSE"

.github/workflows/ci.yaml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  workflow_call:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  sync-check:
+    name: Verify src/ sync
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Check top-level files match src/
+        run: |
+          # Verify distributed files in src/ match the repo's own copies
+          status=0
+          for file in .releaserc.yaml commitlint.config.js; do
+            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+              echo "❌ $file differs from src/$file"
+              diff --color "$file" "src/$file" || true
+              status=1
+            else
+              echo "✅ $file matches src/$file"
+            fi
+          done
+          for file in .github/workflows/commitlint.yml .github/workflows/release.yaml; do
+            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+              echo "❌ $file differs from src/$file"
+              diff --color "$file" "src/$file" || true
+              status=1
+            else
+              echo "✅ $file matches src/$file"
+            fi
+          done
+          if [ $status -ne 0 ]; then
+            echo ""
+            echo "Top-level files and src/ are out of sync."
+            echo "Copy changes to both locations, or run: cp .releaserc.yaml commitlint.config.js src/ && cp .github/workflows/commitlint.yml .github/workflows/release.yaml src/.github/workflows/"
+            exit 1
+          fi
+          echo ""
+          echo "All distributed files in sync ✅"

README.md

@@ -4,6 +4,8 @@ A [common-repo](https://github.com/common-repo/common-repo) source template for
 
 ## What's Included
 
+Files distributed from `src/`:
+
 | File | Purpose |
 |---|---|
 | `.releaserc.yaml` | semantic-release config (conventionalcommits preset, changelog, git, GitHub release, major-tag) |
@@ -32,6 +34,7 @@ Or manually:
 - repo:
     url: https://github.com/christmas-island/cr-semantic-release
     ref: v1.0.0
+    path: src/
 ```
 
 ### Apply
@@ -41,6 +44,28 @@ cr diff    # preview changes
 cr apply   # apply
 ```
 
+## Repo Structure
+
+```
+cr-semantic-release/
+├── .github/workflows/     ← this repo's own CI (dogfooding)
+│   ├── ci.yaml            ← sync check: top-level == src/
+│   ├── commitlint.yml     ← commit linting for this repo
+│   └── release.yaml       ← semantic release for this repo
+├── .releaserc.yaml        ← this repo's own release config
+├── commitlint.config.js   ← this repo's own commitlint
+├── README.md
+├── LICENSE
+└── src/                   ← distributed to consumers via path: src/
+    ├── .github/workflows/
+    │   ├── commitlint.yml
+    │   └── release.yaml
+    ├── .releaserc.yaml
+    └── commitlint.config.js
+```
+
+The top-level files and `src/` files are identical — the repo eats its own dog food. CI enforces they stay in sync.
+
 ## Prerequisites
 
 The release workflow expects the following GitHub org-level vars and secrets:
@@ -62,12 +87,13 @@ The workflow calls `./.github/workflows/ci.yaml` as a prerequisite. Your repo mu
 
 ### Excluding files
 
-If you only want a subset of files:
+If you only want a subset:
 
 ```yaml
 - repo:
     url: https://github.com/christmas-island/cr-semantic-release
     ref: v1.0.0
+    path: src/
     with:
       - exclude: [".github/workflows/commitlint.yml"]
 ```
@@ -80,6 +106,7 @@ Use common-repo's YAML merge operator to patch specific fields:
 - repo:
     url: https://github.com/christmas-island/cr-semantic-release
     ref: v1.0.0
+    path: src/
 - yaml:
     source: my-releaserc-overrides.yaml
     dest: .releaserc.yaml

src/.github/workflows/commitlint.yml

@@ -0,0 +1,20 @@
+name: Commitlint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  commitlint:
+    name: Lint Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548c61b7286b4ffe7cb3d # v6

src/.github/workflows/release.yaml

@@ -0,0 +1,70 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  ci:
+    name: CI
+    permissions:
+      issues: write
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/ci.yaml
+    secrets: inherit
+
+  release:
+    name: Release
+    needs: ci
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
+          private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
+          owner: christmas-island
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          cache: npm
+          cache-dependency-path: ".releaserc.yaml"
+          node-version: lts/*
+      - name: Semantic Release
+        id: release
+        run: |
+          # Semantic Release
+          npm install --no-save --no-package-lock \
+            "@semantic-release/commit-analyzer" \
+            "@semantic-release/release-notes-generator" \
+            "@semantic-release/changelog" \
+            "@semantic-release/git" \
+            "@semantic-release/github" \
+            "semantic-release-major-tag" \
+            "conventional-changelog-conventionalcommits"
+          npx semantic-release > release.log 2>&1 || true
+          cat release.log
+          if grep -q "There are no relevant changes, so no new version is released." release.log; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+    outputs:
+      publish: ${{ steps.release.outputs.publish }}

src/.releaserc.yaml

@@ -0,0 +1,61 @@
+---
+branches:
+  - main
+
+preset: "conventionalcommits"
+tagFormat: "v${version}"
+
+plugins:
+  - - "@semantic-release/commit-analyzer"
+    - preset: conventionalcommits
+  - - "@semantic-release/release-notes-generator"
+    - preset: conventionalcommits
+  - - "@semantic-release/changelog"
+  - - "@semantic-release/git"
+  - - "@semantic-release/github"
+    # Disable noisy issue/PR comments to avoid GH rate limits
+    - failComment: false
+      failTitle: false
+      labels: false
+      releasedLabels: false
+      successComment: false
+  - - "semantic-release-major-tag"
+
+generateNotes:
+  - path: "@semantic-release/release-notes-generator"
+    writerOpts:
+      commitsSort:
+        - subject
+        - scope
+    presetConfig:
+      types:
+        - type: build
+          section: Build System
+          hidden: false
+        - type: chore
+          section: Miscellaneous
+          hidden: false
+        - type: ci
+          section: Continuous Integration
+          hidden: false
+        - type: docs
+          section: Documentation
+          hidden: false
+        - type: feat
+          section: Features
+          hidden: false
+        - type: fix
+          section: Bug Fixes
+          hidden: false
+        - type: perf
+          section: Performance Improvements
+          hidden: false
+        - type: refactor
+          section: Code Refactoring
+          hidden: false
+        - type: style
+          section: Styles
+          hidden: false
+        - type: test
+          section: Tests
+          hidden: false

src/commitlint.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+  extends: ["@commitlint/config-conventional"],
+};