From ddec66b737d2164949719b072cfad8b3285631a8 Mon Sep 17 00:00:00 2001
From: Jean-Paul van Ravensberg <14926452+DevSecNinja@users.noreply.github.com>
Date: Sun, 21 Jun 2026 14:55:30 +0200
Subject: [PATCH 1/2] feat(apm): add APM sync caller to keep installed
 primitives fresh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wire this repo into the central apm-sync reusable (v1.8.0). On a weekly
schedule or manual dispatch it runs `apm update` against apm.yml's
DevSecNinja/ai-toolkit dependency and opens a PR when upstream primitives
changed — activating the apm-sync flow on its first real consumer.

Uses the App identity (RELEASE_PLEASE_APP_ID / _PRIVATE_KEY) so required CI
fires on the sync PR, matching the release-please caller pattern.
---
 .github/workflows/apm-sync-caller.yml | 40 +++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/apm-sync-caller.yml

diff --git a/.github/workflows/apm-sync-caller.yml b/.github/workflows/apm-sync-caller.yml
new file mode 100644
index 0000000..f29b551
--- /dev/null
+++ b/.github/workflows/apm-sync-caller.yml
@@ -0,0 +1,40 @@
+---
+name: APM Sync
+
+# Keeps this repo's installed APM primitives (from DevSecNinja/ai-toolkit,
+# declared in apm.yml) up to date via the central reusable workflow. On a
+# weekly schedule (or manual dispatch) it runs `apm update` and opens a
+# `chore: sync APM primitives` PR when an upstream package shipped changes.
+#
+# This is the agentic-primitive counterpart to config-sync. Branch protection
+# is respected end-to-end — the PR is opened by the App so required CI fires.
+#
+# Onboarding guide:
+#   docs/apm-sync-onboarding.md
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: apm-sync
+  cancel-in-progress: false
+
+jobs:
+  apm-sync:
+    # Self-reference: same repo, pinned to the v1.8.0 tag SHA that introduced
+    # the apm-sync reusable. Re-pin to the next vX.Y.Z tag once cut.
+    uses: DevSecNinja/.github/.github/workflows/apm-sync.yml@7f2abdd838a855dba31a2b2de6358529fdcef09d # v1.8.0
+    permissions:
+      contents: write
+      pull-requests: write
+    with:
+      # renovate: datasource=pypi depName=apm-cli
+      apm-version: "0.21.0"
+      app-id: ${{ vars.RELEASE_PLEASE_APP_ID }}
+    secrets:
+      app-private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}

From 56b966b086db6a8f8e65519abf5d10e0d0afc1a6 Mon Sep 17 00:00:00 2001
From: Jean-Paul van Ravensberg <14926452+DevSecNinja@users.noreply.github.com>
Date: Sun, 21 Jun 2026 14:56:13 +0200
Subject: [PATCH 2/2] ci(apm): track apm CLI version via microsoft/apm github
 releases

The apm-sync reusable installs the CLI from the official aka.ms installer
(microsoft/apm GitHub release), so the Renovate datasource for apm-version
should be github-releases on microsoft/apm, not pypi.
---
 .github/workflows/apm-sync-caller.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/apm-sync-caller.yml b/.github/workflows/apm-sync-caller.yml
index f29b551..bd21440 100644
--- a/.github/workflows/apm-sync-caller.yml
+++ b/.github/workflows/apm-sync-caller.yml
@@ -33,7 +33,9 @@ jobs:
       contents: write
       pull-requests: write
     with:
-      # renovate: datasource=pypi depName=apm-cli
+      # The reusable installs the apm CLI from the official aka.ms installer,
+      # which pulls the microsoft/apm GitHub release.
+      # renovate: datasource=github-releases depName=microsoft/apm
       apm-version: "0.21.0"
       app-id: ${{ vars.RELEASE_PLEASE_APP_ID }}
     secrets: