From 47b90d88f402bb2a0daa2299f6e832070cdbefc2 Mon Sep 17 00:00:00 2001
From: samuelburnham <45365069+samuelburnham@users.noreply.github.com>
Date: Mon, 24 Aug 2026 13:10:08 -0400
Subject: [PATCH] ci: Sync from upstream via the shared ci-workflows workflow

Replace the inline `gh repo sync` step with a call to
`argumentcomputer/ci-workflows/.github/workflows/repo-sync.yml`, so this
repo tracks the org's shared implementation rather than its own copy.

The shared workflow authenticates with a GitHub App installation token
instead of `secrets.GITHUB_TOKEN`, which cannot carry the `workflow`
scope and so refuses any upstream commit touching `.github/workflows/**`.
This requires `TOKEN_APP_ID` and `TOKEN_APP_PRIVATE_KEY` to be available
to the repository.
---
 .github/workflows/repo-sync.yml | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index 81a7346e..fbe12b0b 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -6,13 +6,19 @@ on:
   - cron: "0 0 * * *"
   workflow_dispatch:
 
-permissions:
-  contents: write
+# The sync authenticates with a GitHub App installation token, so the job needs
+# nothing from `secrets.GITHUB_TOKEN`.
+permissions: {}
 
 jobs:
-  sync:
-    runs-on: ubuntu-latest
-    steps:
-      - run: gh repo sync ${{ github.repository }} --branch master --force
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  repo-sync:
+    name: Sync upstream changes
+    uses: argumentcomputer/ci-workflows/.github/workflows/repo-sync.yml@main
+    with:
+      repository: digama0/lean4lean
+      # This fork's default branch is `dev`; `master` is kept as a plain mirror
+      # of upstream, so both sides of the sync share the branch name.
+      branch: master
+    secrets:
+      TOKEN_APP_ID: ${{ secrets.TOKEN_APP_ID }}
+      TOKEN_APP_PRIVATE_KEY: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}