fix(template-sync): migrate the four consumers left on the pre-v11 use-app-token default

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

template-sync's use-app-token input defaulted to true until v11.0.0, which flipped it to
false as a declared breaking change ("template-sync: default App-authored PRs off", #707).
GITHUB_TOKEN can never push workflow files — a GitHub safety restriction the reusable workflow's
own comments already document — so any consumer that relied on the old default silently lost the
ability to sync .github/workflows/** the moment it bumped past v11.

That is not hypothetical. ascoachingogvaner bumped to v11.0.4 on 2026-08-01 and its next scheduled
sync failed:

! [remote rejected] chore/template-sync_53900e1 (refusing to allow a GitHub App to create or update workflow .github/workflows/release.yaml without workflows permission)

A controlled comparison the same morning isolates the variable: wedding-app — sibling tenant of the
same template, same pinned reusable-workflow SHA, same template commit, same 3268-line diff, and
workflow files in the change set — succeeded at 07:13Z. The single difference was
use-app-token: true.

Audience and impact

Every consumer of this reusable workflow, and every repository created from an affected template.
The failure mode is bad in two ways: it is silent until the template happens to change a workflow
file (so it can lie dormant for weeks), and when it does fire the sync stops entirely — meaning
security and CI fixes stop propagating from the template to its tenants.

Expected behaviour

A consumer bumping across a declared breaking change should end up migrated. Six consumers exist and
are all in-house; four still carry the pre-v11 assumption:

Consumer	State
wedding-app	migrated (explicit use-app-token: true)
ascoachingogvaner	broke; hotfixed in devantler-tech/ascoachingogvaner#166
platform-tenant-template	unmigrated — propagates the broken default to every new tenant
platform-template	unmigrated
go-template	unmigrated
dotnet-template	unmigrated

The four template repos skip their own sync (if: github.repository != '<itself>'), so they show no
breakage themselves — they hand it to each tenant created from them. That is why this stayed
invisible.

Acceptance criteria

1. The four unmigrated consumers above explicitly set use-app-token: true, so tenants inherit a
   working sync rather than the broken default.
2. The reusable workflow's README documents the v11 migration step for consumers that sync workflow
   files, next to the existing permissions guidance.
3. Verified by a workflow_dispatch sync on one migrated template-derived tenant that pushes a
   workflow-file change without a rejected push.

Deliberately not proposed: reverting the v11 default. It was a considered security decision —
App-authored PRs trigger the consumer's CI on template content — and opting in per consumer is the
intended migration path, not a workaround.

Rough size: small (a two-line change per repo, plus a README note).

[coderabbitai]

🔗 Related PRs

#599 - fix(auto-merge): complete ineligible required runs [merged]
#612 - fix(release): disable issue notification hooks [merged]
#670 - fix(auto-merge): harden trusted actor enforcement [merged]
#707 - fix(template-sync): default App-authored PRs off [merged]
#811 - fix(auto-merge): close residual event-order gaps [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

This is a regression of a bug that was already fixed once

Checking the older failing runs sharpened the picture: the same push rejection has hit this repo
before, was fixed deliberately, and has now come back.

Date	Result	Cause
2026-06-22 … 07-13 (4 runs)	❌ 11 steps	same refusing to allow a GitHub App to … without 'workflows' permission
2026-07-14	✅	bumped to actions v10.0.0 — the commit message says it plainly: "so target pushes use the App token"
07-20 … 07-22	❌ 0 steps	unrelated org/billing startup failure (#136, since resolved)
2026-07-27	✅	App token still on by default
2026-08-01	—	automated bump to v11.0.4, crossing the declared breaking flip of use-app-token to false
2026-08-03	❌ 10 steps	the 07-14 fix is undone; identical rejection returns

So the fix landed on 07-14, held for two syncs, and was silently reverted by a dependency bump 18 days
later. That is the part worth carrying into devantler-tech/actions#895: the breaking change did not
just leave consumers unmigrated, it undid an explicit fix in a repo that had already hit this exact
failure — and nothing in the bump PR surfaced that.