.common-repo.yaml

@@ -3,5 +3,11 @@
     - "src/**"
     - "src/.*"
     - "src/.*/**"
+- template:
+    - "src/.github/workflows/release.yaml"
+- template-vars:
+    GH_APP_ID_VAR: CHRISTMAS_ISLAND_APP_ID
+    GH_APP_KEY_SECRET: CHRISTMAS_ISLAND_PRIVATE_KEY
+    GH_APP_OWNER: christmas-island
 - rename:
     - "^src/(.*)$": "$1"

.github/workflows/ci.yaml

@@ -25,7 +25,7 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
-          for file in .github/workflows/commitlint.yml .github/workflows/release.yaml; do
+          for file in .github/workflows/commitlint.yml; do
             if ! diff -q "$file" "src/$file" > /dev/null 2>&1; then
               echo "❌ $file differs from src/$file"
               diff --color "$file" "src/$file" || true
@@ -34,6 +34,8 @@ jobs:
               echo "✅ $file matches src/$file"
             fi
           done
+          # release.yaml intentionally differs: src/ uses template vars, top-level uses hardcoded defaults
+          echo "⏭️  .github/workflows/release.yaml skipped (template vars in src/)"
           if [ $status -ne 0 ]; then
             echo ""
             echo "Top-level files and src/ are out of sync."

src/.github/workflows/release.yaml

@@ -32,9 +32,9 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ vars.CHRISTMAS_ISLAND_APP_ID }}
-          private-key: ${{ secrets.CHRISTMAS_ISLAND_PRIVATE_KEY }}
-          owner: christmas-island
+          app-id: ${{ vars.${GH_APP_ID_VAR:-CHRISTMAS_ISLAND_APP_ID} }}
+          private-key: ${{ secrets.${GH_APP_KEY_SECRET:-CHRISTMAS_ISLAND_PRIVATE_KEY} }}
+          owner: ${GH_APP_OWNER:-christmas-island}
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0