fix: rename commitlint.config.js to .cjs for ESM compatibility

wagoid/commitlint-github-action v6.2.1 runs with "type": "module"
in package.json, causing .js files to be treated as ESM. The
module.exports syntax requires CommonJS, so rename to .cjs.

.common-repo-upstream.yaml

@@ -1,10 +0,0 @@
-# Consumer config: inherit shared dev tooling from cr-upstream-repo
-- repo:
-    url: https://github.com/common-repo/cr-upstream-repo
-    ref: v1
-
-# Override upstream template vars for christmas-island
-- template-vars:
-    GH_APP_ID_SECRET: CHRISTMAS_ISLAND_APP_ID
-    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
-    GH_APP_OWNER: christmas-island

.github/workflows/ci.yaml

@@ -1,38 +1,46 @@
 name: CI
 
 on:
+  workflow_call:
   pull_request:
-  push:
     branches:
       - main
-  workflow_call:
-
-permissions:
-  contents: read
 
 jobs:
-  lint:
-    name: Lint
+  sync-check:
+    name: Verify src/ sync
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.x"
-
-      - uses: pre-commit/action@v3.0.1
-
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: common-repo/setup-common-repo@v1
-
-      - name: Validate configuration
-        run: common-repo validate
-
-      - name: Dry-run apply
-        run: common-repo apply --dry-run
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Check top-level files match src/
+        run: |
+          # Verify distributed files in src/ match the repo's own copies
+          status=0
+          for file in .releaserc.yaml commitlint.config.cjs; do
+            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+              echo "❌ $file differs from src/$file"
+              diff --color "$file" "src/$file" || true
+              status=1
+            else
+              echo "✅ $file matches src/$file"
+            fi
+          done
+          for file in .github/workflows/commitlint.yml; do
+            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+              echo "❌ $file differs from src/$file"
+              diff --color "$file" "src/$file" || true
+              status=1
+            else
+              echo "✅ $file matches src/$file"
+            fi
+          done
+          # release.yaml intentionally differs: src/ uses template vars, top-level uses hardcoded defaults
+          echo "⏭️  .github/workflows/release.yaml skipped (template vars in src/)"
+          if [ $status -ne 0 ]; then
+            echo ""
+            echo "Top-level files and src/ are out of sync."
+            echo "Copy changes to both locations, or run: cp .releaserc.yaml commitlint.config.js src/ && cp .github/workflows/commitlint.yml .github/workflows/release.yaml src/.github/workflows/"
+            exit 1
+          fi
+          echo ""
+          echo "All distributed files in sync ✅"

.github/workflows/commitlint.yml

@@ -14,8 +14,7 @@ jobs:
     name: Lint Commits
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
-
-      - uses: wagoid/commitlint-github-action@v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6

.github/workflows/common-repo-check.yaml

@@ -1,25 +0,0 @@
-name: common-repo check
-
-on:
-  schedule:
-    # Run daily at 08:00 UTC
-    - cron: "0 8 * * *"
-  workflow_dispatch:
-
-jobs:
-  check:
-    name: Check for upstream updates
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: common-repo/setup-common-repo@v1
-
-      - name: Check for updates
-        run: common-repo check --updates --config .common-repo-upstream.yaml
-
-      - name: Show diff
-        run: |
-          common-repo diff --config .common-repo-upstream.yaml --summary || true
-          echo "---"
-          common-repo diff --config .common-repo-upstream.yaml || true

.github/workflows/release.yaml

@@ -30,24 +30,21 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ secrets.CHRISTMAS_ISLAND_APP_ID }}
+          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
           private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
           owner: christmas-island
-
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
-
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           cache: npm
           cache-dependency-path: ".releaserc.yaml"
           node-version: lts/*
-
       - name: Semantic Release
         id: release
         run: |

.pre-commit-config.yaml

@@ -1,10 +0,0 @@
-repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-yaml
-        args: [--allow-multiple-documents]
-      - id: check-merge-conflict
-      - id: check-added-large-files

CHANGELOG.md

@@ -1,9 +1,3 @@
-## [1.3.0](https://github.com/christmas-island/cr-semantic-release/compare/v1.2.1...v1.3.0) (2026-03-15)
-
-### Features
-
-* restore template vars for GitHub App customization ([#1](https://github.com/christmas-island/cr-semantic-release/issues/1)) ([9c4c15d](https://github.com/christmas-island/cr-semantic-release/commit/9c4c15d722cee528df2987faf29d8d6380da79ff))
-
 ## [1.2.1](https://github.com/christmas-island/cr-semantic-release/compare/v1.2.0...v1.2.1) (2026-03-15)
 
 ### Bug Fixes