refactor(apply-repo-settings): remove all templating; action is now pure merge

The action no longer takes app-id or private-key — it requires only a
pre-generated token (with administration:write). It applies the settings
file verbatim, with no placeholder substitution.

Templating moved upstream to nsheaps/.github, where repo-settings.template.yaml
is rendered (envsubst) into repo-settings.yaml at the source.

https://claude.ai/code/session_01XUJx6sKWxyKyoWdxNEsET1

Author: nsheaps

.github/actions/apply-repo-settings/README.md

@@ -10,15 +10,16 @@ The upstream app is a Probot webhook server — it's designed to listen for `pus
 
 ## Inputs
 
-| Input           | Required | Default                | Description                                                        |
-| --------------- | -------- | ---------------------- | ------------------------------------------------------------------ |
-| `app-id`        | yes      | —                      | GitHub App ID. Needs `Administration: write` and `Contents: read`. |
-| `private-key`   | yes      | —                      | The App's PEM private key.                                         |
-| `owner`         | no       | current owner          | Target repo owner.                                                 |
-| `repo`          | no       | current repo           | Target repo name.                                                  |
-| `settings-file` | no       | `.github/settings.yml` | Path to the YAML to apply.                                         |
-| `dry-run`       | no       | `false`                | Print what would change without applying.                          |
-| `sections`      | no       | `repository,rulesets`  | Comma-separated section names to apply.                            |
+| Input           | Required | Default                | Description                                                                                                                |
+| --------------- | -------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `token`         | yes      | —                      | GitHub token with `Administration: write` on the target repo (typically from `checkout-as-app` or `github-app-auth`).      |
+| `owner`         | no       | current owner          | Target repo owner.                                                                                                         |
+| `repo`          | no       | current repo           | Target repo name.                                                                                                          |
+| `settings-file` | no       | `.github/settings.yml` | Path to the YAML to apply.                                                                                                 |
+| `dry-run`       | no       | `false`                | Print what would change without applying.                                                                                  |
+| `sections`      | no       | `repository,rulesets`  | Comma-separated section names to apply.                                                                                    |
+
+The action does **not** do any templating or placeholder substitution on `settings-file` — it applies the YAML as-is. If you need env-var-based substitution (e.g. resolving a GitHub App ID into `bypass_actors[].actor_id`), render the file upstream (e.g. with `envsubst`) before invoking this action.
 
 ## Outputs
 
@@ -37,7 +38,7 @@ Source: [`pages/index.html`](../../../pages/index.html). Deployed by [`.github/w
 After creating the app:
 
 1. Install it on every repo you want to manage.
-2. Add `APPLY_REPO_SETTINGS_APP_ID` and `APPLY_REPO_SETTINGS_PRIVATE_KEY` as secrets.
+2. Add `APPLY_REPO_SETTINGS_APP_ID` and `APPLY_REPO_SETTINGS_PRIVATE_KEY` as secrets (consumed by `checkout-as-app` / `github-app-auth` — this action only takes the resulting token).
 
 ## Example workflow
 
@@ -65,11 +66,15 @@ jobs:
   apply:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: nsheaps/github-actions/.github/actions/apply-repo-settings@main
+      - name: Checkout as GitHub App
+        id: checkout
+        uses: nsheaps/github-actions/.github/actions/checkout-as-app@main
         with:
           app-id: ${{ secrets.APPLY_REPO_SETTINGS_APP_ID }}
           private-key: ${{ secrets.APPLY_REPO_SETTINGS_PRIVATE_KEY }}
+      - uses: nsheaps/github-actions/.github/actions/apply-repo-settings@main
+        with:
+          token: ${{ steps.checkout.outputs.token }}
           dry-run: ${{ inputs.dry-run || false }}
 ```
 

.github/actions/apply-repo-settings/action.sh

@@ -17,9 +17,6 @@ set -euo pipefail
 : "${SETTINGS_FILE:=.github/settings.yml}"
 : "${DRY_RUN:=false}"
 : "${SECTIONS:=repository,rulesets}"
-: "${APP_ID:=}"
-# APP_ID is only needed if the settings file still contains actor_id: -1 placeholders.
-# Normally the .github sync workflow resolves placeholders before distributing settings.yml.
 
 if [[ ! -f "$SETTINGS_FILE" ]]; then
   echo "::error file=$SETTINGS_FILE::settings file not found"
@@ -132,19 +129,6 @@ apply_rulesets() {
     name="$(yq -r ".rulesets[$i].name" "$SETTINGS_FILE")"
     body="$(yq -o=json ".rulesets[$i]" "$SETTINGS_FILE")"
 
-    # Substitute actor_id -1 placeholder for Integration bypass actors with the real App ID.
-    # actor_id must be the GitHub App ID (integer), not the installation ID.
-    # Gracefully skip Integration bypass actors if APP_ID is not configured.
-    if [[ -n "$APP_ID" ]]; then
-      body="$(echo "$body" | jq \
-        --argjson app_id "$APP_ID" \
-        '.bypass_actors //= [] | .bypass_actors |= map(if .actor_type == "Integration" and .actor_id == -1 then .actor_id = $app_id else . end)')"
-    else
-      body="$(echo "$body" | jq \
-        'if .bypass_actors then .bypass_actors |= map(select(not (.actor_type == "Integration" and .actor_id == -1))) else . end')"
-      info "APP_ID not set — skipping placeholder Integration bypass actors for: $name"
-    fi
-
     existing_id="$(echo "$existing" | jq -r --arg n "$name" '.[] | select(.name == $n) | .id // empty')"
 
     if [[ -z "$existing_id" ]]; then

.github/actions/apply-repo-settings/action.yml

@@ -7,19 +7,8 @@ branding:
 
 inputs:
   token:
-    description: 'Pre-generated GitHub App installation token. When provided, app-id/private-key are not used for authentication. app-id is still required for substituting the actor_id: -1 placeholder in Integration bypass actors.'
-    required: false
-    default: ''
-
-  app-id:
-    description: 'GitHub App ID. Used to substitute the actor_id: -1 placeholder in Integration bypass actors. Also used for authentication when token is not provided. When token is provided and app-id is omitted, the app ID is derived from the installation token at runtime via GET /app.'
-    required: false
-    default: ''
-
-  private-key:
-    description: 'GitHub App private key (PEM). Required when token is not provided.'
-    required: false
-    default: ''
+    description: 'GitHub token with administration:write on the target repo (typically a GitHub App installation token from checkout-as-app or github-app-auth).'
+    required: true
 
   owner:
     description: 'Target repo owner. Defaults to the current repo owner.'
@@ -54,16 +43,6 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - name: Authenticate as GitHub App
-      id: app-token
-      if: ${{ inputs.token == '' }}
-      uses: nsheaps/github-actions/.github/actions/github-app-auth@603052841cd49b9fdc99bc32979ff9c45c9b669e # 2026-05-22
-      with:
-        app-id: ${{ inputs.app-id }}
-        private-key: ${{ inputs.private-key }}
-        owner: ${{ inputs.owner }}
-        skip-checkout: 'true'
-
     - name: Ensure yq is available
       shell: bash
       run: |
@@ -78,8 +57,7 @@ runs:
       id: apply
       shell: bash
       env:
-        GH_TOKEN: ${{ inputs.token || steps.app-token.outputs.token }}
-        APP_ID: ${{ inputs.app-id }}
+        GH_TOKEN: ${{ inputs.token }}
         OWNER: ${{ inputs.owner }}
         REPO: ${{ inputs.repo }}
         SETTINGS_FILE: ${{ inputs.settings-file }}