fix: remove incorrect excludes and inherit all upstream-owned files

The upstream repo's src/ defines what gets distributed — all of those
files should be inherited. Override template vars for christmas-island
credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.common-repo-upstream.yaml

@@ -0,0 +1,10 @@
+# Consumer config: inherit shared dev tooling from cr-upstream-repo
+- repo:
+    url: https://github.com/common-repo/cr-upstream-repo
+    ref: v1
+
+# Override upstream template vars for christmas-island
+- template-vars:
+    GH_APP_ID_SECRET: CHRISTMAS_ISLAND_APP_ID
+    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
+    GH_APP_OWNER: christmas-island

.common-repo.yaml

@@ -1,7 +1,13 @@
-# Source-level common-repo config
-# Excludes files that are part of this template repo itself,
-# not intended to be distributed to consumers.
-- exclude:
-    - "README.md"
-    - ".common-repo.yaml"
-    - "LICENSE"
+# Source-level config: only expose src/ contents, renamed to root.
+- include:
+    - "src/**"
+    - "src/.*"
+    - "src/.*/**"
+- template:
+    - "src/.github/workflows/release.yaml"
+- template-vars:
+    GH_APP_ID_VAR: CHRISTMAS_ISLAND_APP_ID
+    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
+    GH_APP_OWNER: christmas-island
+- rename:
+    - "^src/(.*)$": "$1"

.github/workflows/ci.yaml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - uses: pre-commit/action@v3.0.1
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: common-repo/setup-common-repo@v1
+
+      - name: Validate configuration
+        run: common-repo validate
+
+      - name: Dry-run apply
+        run: common-repo apply --dry-run

.github/workflows/commitlint.yml

@@ -14,7 +14,8 @@ jobs:
     name: Lint Commits
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548c61b7286b4ffe7cb3d # v6
+
+      - uses: wagoid/commitlint-github-action@v6

.github/workflows/common-repo-check.yaml

@@ -0,0 +1,25 @@
+name: common-repo check
+
+on:
+  schedule:
+    # Run daily at 08:00 UTC
+    - cron: "0 8 * * *"
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: Check for upstream updates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: common-repo/setup-common-repo@v1
+
+      - name: Check for updates
+        run: common-repo check --updates --config .common-repo-upstream.yaml
+
+      - name: Show diff
+        run: |
+          common-repo diff --config .common-repo-upstream.yaml --summary || true
+          echo "---"
+          common-repo diff --config .common-repo-upstream.yaml || true

.github/workflows/release.yaml

@@ -30,21 +30,24 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
-          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
+          app-id: ${{ secrets.CHRISTMAS_ISLAND_APP_ID }}
           private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
           owner: christmas-island
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           cache-dependency-path: ".releaserc.yaml"
           node-version: lts/*
+
       - name: Semantic Release
         id: release
         run: |

.pre-commit-config.yaml

@@ -0,0 +1,10 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-merge-conflict
+      - id: check-added-large-files

CHANGELOG.md

@@ -0,0 +1,53 @@
+## [1.3.0](https://github.com/christmas-island/cr-semantic-release/compare/v1.2.1...v1.3.0) (2026-03-15)
+
+### Features
+
+* restore template vars for GitHub App customization ([#1](https://github.com/christmas-island/cr-semantic-release/issues/1)) ([9c4c15d](https://github.com/christmas-island/cr-semantic-release/commit/9c4c15d722cee528df2987faf29d8d6380da79ff))
+
+## [1.2.1](https://github.com/christmas-island/cr-semantic-release/compare/v1.2.0...v1.2.1) (2026-03-15)
+
+### Bug Fixes
+
+* revert template vars — GHA ${{ }} collides with ${} template syntax ([e4a8514](https://github.com/christmas-island/cr-semantic-release/commit/e4a8514405acb48c8dcd5be8df63fa8c67f57384)), closes [common-repo/common-repo#TBD](https://github.com/common-repo/common-repo/issues/TBD)
+
+## [1.2.0](https://github.com/christmas-island/cr-semantic-release/compare/v1.1.0...v1.2.0) (2026-03-15)
+
+### Documentation
+
+* clean up README now that source filtering works on >=0.28.0 ([58003db](https://github.com/christmas-island/cr-semantic-release/commit/58003db568089843a5727a896cbb7b250e0f32ba))
+
+### Features
+
+* templatize GitHub App vars in release workflow ([402ea38](https://github.com/christmas-island/cr-semantic-release/commit/402ea389ee69ad21a40ad1a7d5d144324672fc72))
+
+### Bug Fixes
+
+* template glob should use post-rename path ([6345772](https://github.com/christmas-island/cr-semantic-release/commit/63457723cc0c26fbb1d17c5cf333b68f01ff991f))
+* template mark must use pre-rename path, move before rename ([d41cb34](https://github.com/christmas-island/cr-semantic-release/commit/d41cb341b463f24c6fe3891af16fb7354f92a956))
+
+## [1.1.0](https://github.com/christmas-island/cr-semantic-release/compare/v1.0.1...v1.1.0) (2026-03-15)
+
+### Documentation
+
+* update usage for common-repo 0.27.0 workaround ([e99caf6](https://github.com/christmas-island/cr-semantic-release/commit/e99caf614571bb35b4a95c44dcd7f94011074bac)), closes [common-repo/common-repo#229](https://github.com/common-repo/common-repo/issues/229) [#230](https://github.com/christmas-island/cr-semantic-release/issues/230)
+
+### Features
+
+* restore source-declared filtering (requires common-repo >=0.28.0) ([8ba5ad3](https://github.com/christmas-island/cr-semantic-release/commit/8ba5ad3b433fd5edbd13c8c9452f77ea914869bd))
+
+## [1.0.1](https://github.com/christmas-island/cr-semantic-release/compare/v1.0.0...v1.0.1) (2026-03-15)
+
+### Miscellaneous
+
+* add source-level common-repo config ([0f70793](https://github.com/christmas-island/cr-semantic-release/commit/0f70793fe8256fe6f5efd44a5d4e92ce41715643))
+* fix source config format ([d911531](https://github.com/christmas-island/cr-semantic-release/commit/d911531f6fb883bccf77c984275dffae28ea4098))
+* fix source config to documented format ([ff206f0](https://github.com/christmas-island/cr-semantic-release/commit/ff206f01ee54b0fae959bdd636e81789f72a0e38))
+* try exclude instead of include ([22ab420](https://github.com/christmas-island/cr-semantic-release/commit/22ab4208bb2c8afb640fcbe79acc0c3f8efdb7b7))
+
+### Bug Fixes
+
+* remove non-functional source .common-repo.yaml ([9e46120](https://github.com/christmas-island/cr-semantic-release/commit/9e46120f54deea9fe375a6f609e94cef5cf4164a)), closes [common-repo/common-repo#226](https://github.com/common-repo/common-repo/issues/226)
+
+### Code Refactoring
+
+* move distributed files to src/, add sync check CI ([aa94b0a](https://github.com/christmas-island/cr-semantic-release/commit/aa94b0a05736491d5fa3a27f409a7cdb45a73086))

README.md

@@ -4,6 +4,8 @@ A [common-repo](https://github.com/common-repo/common-repo) source template for
 
 ## What's Included
 
+Files distributed from `src/`:
+
 | File | Purpose |
 |---|---|
 | `.releaserc.yaml` | semantic-release config (conventionalcommits preset, changelog, git, GitHub release, major-tag) |
@@ -13,27 +15,19 @@ A [common-repo](https://github.com/common-repo/common-repo) source template for
 
 ## Usage
 
-### Add to a new repo
-
-```bash
-cr init https://github.com/christmas-island/cr-semantic-release
-```
+> **Requires common-repo ≥ 0.28.4** for source-declared filtering and template variable overrides.
 
 ### Add to an existing `.common-repo.yaml`
 
-```bash
-cr add https://github.com/christmas-island/cr-semantic-release
-```
-
-Or manually:
-
 ```yaml
 # .common-repo.yaml
 - repo:
     url: https://github.com/christmas-island/cr-semantic-release
-    ref: v1.0.0
+    ref: v1.1.0
 ```
 
+That's it. The source repo's `.common-repo.yaml` handles scoping to `src/` and stripping the prefix.
+
 ### Apply
 
 ```bash
@@ -41,17 +35,57 @@ cr diff    # preview changes
 cr apply   # apply
 ```
 
+## Repo Structure
+
+```
+cr-semantic-release/
+├── .common-repo.yaml      ← source-declared filtering (include src/, rename to root)
+├── .github/workflows/     ← this repo's own CI (dogfooding)
+│   ├── ci.yaml            ← sync check: top-level == src/
+│   ├── commitlint.yml     ← commit linting for this repo
+│   └── release.yaml       ← semantic release for this repo
+├── .releaserc.yaml        ← this repo's own release config
+├── commitlint.config.js   ← this repo's own commitlint
+├── README.md
+├── LICENSE
+└── src/                   ← distributed to consumers
+    ├── .github/workflows/
+    │   ├── commitlint.yml
+    │   └── release.yaml
+    ├── .releaserc.yaml
+    └── commitlint.config.js
+```
+
+The top-level files and `src/` files are identical — the repo eats its own dog food. CI enforces they stay in sync (except `release.yaml`, which uses template variables in `src/` and hardcoded defaults at the top level).
+
 ## Prerequisites
 
-The release workflow expects the following GitHub org-level vars and secrets:
+By default, the release workflow uses these GitHub org-level vars and secrets:
 
-| Name | Type | Purpose |
-|---|---|---|
-| `CHRISTMAS_ISLAND_APP_ID` | Variable | GitHub App ID for generating tokens |
-| `CHRISTMAS_ISLAND_PRIVATE_KEY` | Secret | GitHub App private key |
+| Name | Type | Default | Purpose |
+|---|---|---|---|
+| `CHRISTMAS_ISLAND_APP_ID` | Variable | — | GitHub App ID for generating tokens |
+| `CHRISTMAS_ISLAND_PRIVATE_KEY` | Secret | — | GitHub App private key |
 
 These are used by `actions/create-github-app-token` to generate a token with write permissions for creating releases and pushing tags/changelogs.
 
+### Using a different GitHub App
+
+Override the template variables in your consumer config to use your own app credentials:
+
+```yaml
+- repo:
+    url: https://github.com/christmas-island/cr-semantic-release
+    ref: v2.0.0
+    with:
+      - template-vars:
+          GH_APP_ID_VAR: MY_APP_ID          # GitHub vars name
+          GH_APP_KEY_SECRET: MY_APP_KEY      # GitHub secrets name
+          GH_APP_OWNER: my-org               # App installation owner
+```
+
+This renders the workflow with `${{ vars.MY_APP_ID }}`, `${{ secrets.MY_APP_KEY }}`, and `owner: my-org`.
+
 ## Customization
 
 ### Release workflow
@@ -62,14 +96,16 @@ The workflow calls `./.github/workflows/ci.yaml` as a prerequisite. Your repo mu
 
 ### Excluding files
 
-If you only want a subset of files:
+If you only want a subset:
 
 ```yaml
 - repo:
     url: https://github.com/christmas-island/cr-semantic-release
-    ref: v1.0.0
+    ref: v1.1.0
     with:
-      - exclude: [".github/workflows/commitlint.yml"]
+      - include: ["src/.releaserc.yaml", "src/commitlint.config.js"]
+      - rename:
+          - "^src/(.*)$": "$1"
 ```
 
 ### Overriding `.releaserc.yaml`
@@ -79,7 +115,7 @@ Use common-repo's YAML merge operator to patch specific fields:
 ```yaml
 - repo:
     url: https://github.com/christmas-island/cr-semantic-release
-    ref: v1.0.0
+    ref: v1.1.0
 - yaml:
     source: my-releaserc-overrides.yaml
     dest: .releaserc.yaml

src/.github/workflows/commitlint.yml

@@ -0,0 +1,20 @@
+name: Commitlint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  commitlint:
+    name: Lint Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6

src/.github/workflows/release.yaml

@@ -0,0 +1,70 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  ci:
+    name: CI
+    permissions:
+      issues: write
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/ci.yaml
+    secrets: inherit
+
+  release:
+    name: Release
+    needs: ci
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.${GH_APP_ID_VAR:-CHRISTMAS_ISLAND_APP_ID} }}
+          private-key: ${{ secrets.${GH_APP_KEY_SECRET:-CHRISTMAS_ISLAND_PRIVATE_KEY} }}
+          owner: ${GH_APP_OWNER:-christmas-island}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          cache: npm
+          cache-dependency-path: ".releaserc.yaml"
+          node-version: lts/*
+      - name: Semantic Release
+        id: release
+        run: |
+          # Semantic Release
+          npm install --no-save --no-package-lock \
+            "@semantic-release/commit-analyzer" \
+            "@semantic-release/release-notes-generator" \
+            "@semantic-release/changelog" \
+            "@semantic-release/git" \
+            "@semantic-release/github" \
+            "semantic-release-major-tag" \
+            "conventional-changelog-conventionalcommits"
+          npx semantic-release > release.log 2>&1 || true
+          cat release.log
+          if grep -q "There are no relevant changes, so no new version is released." release.log; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+    outputs:
+      publish: ${{ steps.release.outputs.publish }}

src/.releaserc.yaml

@@ -0,0 +1,61 @@
+---
+branches:
+  - main
+
+preset: "conventionalcommits"
+tagFormat: "v${version}"
+
+plugins:
+  - - "@semantic-release/commit-analyzer"
+    - preset: conventionalcommits
+  - - "@semantic-release/release-notes-generator"
+    - preset: conventionalcommits
+  - - "@semantic-release/changelog"
+  - - "@semantic-release/git"
+  - - "@semantic-release/github"
+    # Disable noisy issue/PR comments to avoid GH rate limits
+    - failComment: false
+      failTitle: false
+      labels: false
+      releasedLabels: false
+      successComment: false
+  - - "semantic-release-major-tag"
+
+generateNotes:
+  - path: "@semantic-release/release-notes-generator"
+    writerOpts:
+      commitsSort:
+        - subject
+        - scope
+    presetConfig:
+      types:
+        - type: build
+          section: Build System
+          hidden: false
+        - type: chore
+          section: Miscellaneous
+          hidden: false
+        - type: ci
+          section: Continuous Integration
+          hidden: false
+        - type: docs
+          section: Documentation
+          hidden: false
+        - type: feat
+          section: Features
+          hidden: false
+        - type: fix
+          section: Bug Fixes
+          hidden: false
+        - type: perf
+          section: Performance Improvements
+          hidden: false
+        - type: refactor
+          section: Code Refactoring
+          hidden: false
+        - type: style
+          section: Styles
+          hidden: false
+        - type: test
+          section: Tests
+          hidden: false

src/commitlint.config.cjs

@@ -0,0 +1,3 @@
+module.exports = {
+  extends: ["@commitlint/config-conventional"],
+};