ci: run TechAPI automation as reusable workflows without personal tokens

.github/workflows/coverage-report.yml

@@ -1,17 +1,17 @@
 name: coverage-report
 
-# Daily: pull upstream catalogs, diff vs the curated TechAPI dataset, post
-# the gap list as a sticky issue (auto-updates the existing one each run).
+# Weekly: pull upstream catalogs, diff vs the curated TechAPI dataset, post
+# the gap list as a sticky issue in this repo (auto-updates the existing one).
 on:
   schedule:
-    - cron: "23 6 * * *"   # Daily 06:23 UTC (reads curated data/, so safe to run every day)
+    - cron: "23 6 * * 1"   # Mondays 06:23 UTC
   workflow_dispatch:
 
 permissions:
   contents: read
   issues: write
 
-# Guard against a slow run overlapping the next day's scheduled run.
+# Guard against a slow run overlapping the next scheduled run.
 concurrency:
   group: coverage-report
   cancel-in-progress: false
@@ -45,42 +45,18 @@ jobs:
           name: coverage-report
           path: coverage-report.md
 
-      # Sticky issue: keep one open issue with the well-known title per repo,
-      # updating it in place. Posts to BOTH TechEngine and TechAPI.
-      #
-      # Authorship: a GitHub issue's author is the account behind the *token*
-      # (unlike a commit, it cannot be set via git config). To attribute the
-      # auto-generated issues to TechEngineBot, set a TechEngineBot PAT with
-      # Issues:write on both repos as the TECHENGINEBOT_TOKEN secret; the steps
-      # below prefer it. Without it they fall back to the default GITHUB_TOKEN
-      # (TechEngine, authored by github-actions) and TECHAPI_TOKEN (TechAPI).
-      - name: Sync sticky coverage issue (TechEngine + TechAPI)
+      # Sticky issue: keep one open issue with the well-known title, updating it
+      # in place. Only this repo, with its own GITHUB_TOKEN (github-actions[bot]).
+      - name: Sync sticky coverage issue
         env:
-          BOT_TOKEN: ${{ secrets.TECHENGINEBOT_TOKEN }}
-          SELF_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TECHAPI_TOKEN: ${{ secrets.TECHAPI_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
-          set -uo pipefail
+          set -euo pipefail
           TITLE="Coverage gaps (auto-generated)"
-          BODY="$(cat coverage-report.md)"
-          sync_issue() {
-            repo="$1"; token="$2"
-            if [ -z "$token" ]; then
-              echo "::warning::no token for $repo; skipping coverage issue"
-              return 0
-            fi
-            NUMBER=$(GH_TOKEN="$token" gh issue list --repo "$repo" --state open \
-              --search "in:title \"$TITLE\"" --json number --jq '.[0].number // empty') || return 1
-            if [ -z "${NUMBER:-}" ]; then
-              GH_TOKEN="$token" gh issue create --repo "$repo" --title "$TITLE" --body "$BODY"
-            else
-              GH_TOKEN="$token" gh issue edit "$NUMBER" --repo "$repo" --body "$BODY"
-            fi
-          }
-          # Prefer the TechEngineBot PAT (so the issue is authored by the bot);
-          # fall back to the per-repo defaults when it is not configured.
-          sync_issue "${{ github.repository }}" "${BOT_TOKEN:-$SELF_TOKEN}" \
-            || echo "::warning::TechEngine coverage issue sync failed"
-          # TechAPI: best-effort — requires Issues:write on the chosen token.
-          sync_issue "GetTechAPI/TechAPI" "${BOT_TOKEN:-$TECHAPI_TOKEN}" \
-            || echo "::warning::TechAPI coverage issue sync failed — token likely lacks Issues:write"
+          NUMBER=$(gh issue list --repo "${{ github.repository }}" --state open \
+            --search "in:title \"$TITLE\"" --json number --jq '.[0].number // empty')
+          if [ -z "${NUMBER:-}" ]; then
+            gh issue create --repo "${{ github.repository }}" --title "$TITLE" --body-file coverage-report.md
+          else
+            gh issue edit "$NUMBER" --repo "${{ github.repository }}" --body-file coverage-report.md
+          fi