fix: remove incorrect excludes and inherit all upstream-owned files

The upstream repo's src/ defines what gets distributed — all of those
files should be inherited. Override template vars for christmas-island
credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.common-repo-upstream.yaml

@@ -0,0 +1,10 @@
+# Consumer config: inherit shared dev tooling from cr-upstream-repo
+- repo:
+    url: https://github.com/common-repo/cr-upstream-repo
+    ref: v1
+
+# Override upstream template vars for christmas-island
+- template-vars:
+    GH_APP_ID_SECRET: CHRISTMAS_ISLAND_APP_ID
+    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
+    GH_APP_OWNER: christmas-island

.common-repo.yaml

@@ -3,5 +3,11 @@
     - "src/**"
     - "src/.*"
     - "src/.*/**"
+- template:
+    - "src/.github/workflows/release.yaml"
+- template-vars:
+    GH_APP_ID_VAR: CHRISTMAS_ISLAND_APP_ID
+    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
+    GH_APP_OWNER: christmas-island
 - rename:
     - "^src/(.*)$": "$1"

.github/workflows/ci.yaml

@@ -1,44 +1,38 @@
 name: CI
 
 on:
-  workflow_call:
   pull_request:
+  push:
     branches:
       - main
+  workflow_call:
+
+permissions:
+  contents: read
 
 jobs:
-  sync-check:
+  lint:
-    name: Verify src/ sync
+    name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@v4
-      - name: Check top-level files match src/
+
-        run: |
+      - uses: actions/setup-python@v5
-          # Verify distributed files in src/ match the repo's own copies
+        with:
-          status=0
+          python-version: "3.x"
-          for file in .releaserc.yaml commitlint.config.js; do
+
-            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+      - uses: pre-commit/action@v3.0.1
-              echo "❌ $file differs from src/$file"
+
-              diff --color "$file" "src/$file" || true
+  test:
-              status=1
+    name: Test
-            else
+    runs-on: ubuntu-latest
-              echo "✅ $file matches src/$file"
+    steps:
-            fi
+      - uses: actions/checkout@v4
-          done
+
-          for file in .github/workflows/commitlint.yml .github/workflows/release.yaml; do
+      - uses: common-repo/setup-common-repo@v1
-            if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
+
-              echo "❌ $file differs from src/$file"
+      - name: Validate configuration
-              diff --color "$file" "src/$file" || true
+        run: common-repo validate
-              status=1
+
-            else
+      - name: Dry-run apply
-              echo "✅ $file matches src/$file"
+        run: common-repo apply --dry-run
-            fi
-          done
-          if [ $status -ne 0 ]; then
-            echo ""
-            echo "Top-level files and src/ are out of sync."
-            echo "Copy changes to both locations, or run: cp .releaserc.yaml commitlint.config.js src/ && cp .github/workflows/commitlint.yml .github/workflows/release.yaml src/.github/workflows/"
-            exit 1
-          fi
-          echo ""
-          echo "All distributed files in sync ✅"

.github/workflows/commitlint.yml

@@ -14,7 +14,8 @@ jobs:
     name: Lint Commits
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548c61b7286b4ffe7cb3d # v6
+
+      - uses: wagoid/commitlint-github-action@v6

.github/workflows/common-repo-check.yaml

@@ -0,0 +1,25 @@
+name: common-repo check
+
+on:
+  schedule:
+    # Run daily at 08:00 UTC
+    - cron: "0 8 * * *"
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: Check for upstream updates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: common-repo/setup-common-repo@v1
+
+      - name: Check for updates
+        run: common-repo check --updates --config .common-repo-upstream.yaml
+
+      - name: Show diff
+        run: |
+          common-repo diff --config .common-repo-upstream.yaml --summary || true
+          echo "---"
+          common-repo diff --config .common-repo-upstream.yaml || true

.github/workflows/release.yaml

@@ -30,21 +30,24 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
-          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
+          app-id: ${{ secrets.CHRISTMAS_ISLAND_APP_ID }}
           private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
           owner: christmas-island
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           cache-dependency-path: ".releaserc.yaml"
           node-version: lts/*
+
       - name: Semantic Release
         id: release
         run: |

.pre-commit-config.yaml

@@ -0,0 +1,10 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-merge-conflict
+      - id: check-added-large-files

CHANGELOG.md

@@ -1,3 +1,15 @@
+## [1.3.0](https://github.com/christmas-island/cr-semantic-release/compare/v1.2.1...v1.3.0) (2026-03-15)
+
+### Features
+
+* restore template vars for GitHub App customization ([#1](https://github.com/christmas-island/cr-semantic-release/issues/1)) ([9c4c15d](https://github.com/christmas-island/cr-semantic-release/commit/9c4c15d722cee528df2987faf29d8d6380da79ff))
+
+## [1.2.1](https://github.com/christmas-island/cr-semantic-release/compare/v1.2.0...v1.2.1) (2026-03-15)
+
+### Bug Fixes
+
+* revert template vars — GHA ${{ }} collides with ${} template syntax ([e4a8514](https://github.com/christmas-island/cr-semantic-release/commit/e4a8514405acb48c8dcd5be8df63fa8c67f57384)), closes [common-repo/common-repo#TBD](https://github.com/common-repo/common-repo/issues/TBD)
+
 ## [1.2.0](https://github.com/christmas-island/cr-semantic-release/compare/v1.1.0...v1.2.0) (2026-03-15)
 
 ### Documentation

README.md

@@ -15,7 +15,7 @@ Files distributed from `src/`:
 
 ## Usage
 
-> **Requires common-repo ≥ 0.28.0** for source-declared filtering.
+> **Requires common-repo ≥ 0.28.4** for source-declared filtering and template variable overrides.
 
 ### Add to an existing `.common-repo.yaml`
 
@@ -56,19 +56,36 @@ cr-semantic-release/
     └── commitlint.config.js
 ```
 
-The top-level files and `src/` files are identical — the repo eats its own dog food. CI enforces they stay in sync.
+The top-level files and `src/` files are identical — the repo eats its own dog food. CI enforces they stay in sync (except `release.yaml`, which uses template variables in `src/` and hardcoded defaults at the top level).
 
 ## Prerequisites
 
-The release workflow expects the following GitHub org-level vars and secrets:
+By default, the release workflow uses these GitHub org-level vars and secrets:
 
-| Name | Type | Purpose |
+| Name | Type | Default | Purpose |
-|---|---|---|
+|---|---|---|---|
-| `CHRISTMAS_ISLAND_APP_ID` | Variable | GitHub App ID for generating tokens |
+| `CHRISTMAS_ISLAND_APP_ID` | Variable | — | GitHub App ID for generating tokens |
-| `CHRISTMAS_ISLAND_PRIVATE_KEY` | Secret | GitHub App private key |
+| `CHRISTMAS_ISLAND_PRIVATE_KEY` | Secret | — | GitHub App private key |
 
 These are used by `actions/create-github-app-token` to generate a token with write permissions for creating releases and pushing tags/changelogs.
 
+### Using a different GitHub App
+
+Override the template variables in your consumer config to use your own app credentials:
+
+```yaml
+- repo:
+    url: https://github.com/christmas-island/cr-semantic-release
+    ref: v2.0.0
+    with:
+      - template-vars:
+          GH_APP_ID_VAR: MY_APP_ID          # GitHub vars name
+          GH_APP_KEY_SECRET: MY_APP_KEY      # GitHub secrets name
+          GH_APP_OWNER: my-org               # App installation owner
+```
+
+This renders the workflow with `${{ vars.MY_APP_ID }}`, `${{ secrets.MY_APP_KEY }}`, and `owner: my-org`.
+
 ## Customization
 
 ### Release workflow

src/.github/workflows/commitlint.yml

@@ -17,4 +17,4 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548c61b7286b4ffe7cb3d # v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6

src/.github/workflows/release.yaml

@@ -32,9 +32,9 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
+          app-id: ${{ vars.${GH_APP_ID_VAR:-CHRISTMAS_ISLAND_APP_ID} }}
-          private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
+          private-key: ${{ secrets.${GH_APP_KEY_SECRET:-CHRISTMAS_ISLAND_PRIVATE_KEY} }}
-          owner: christmas-island
+          owner: ${GH_APP_OWNER:-christmas-island}
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0