🚀 [Feature]: File distribution service for organization repositories

[Copilot]

The Distributor service provides a centralized, convention-based mechanism for syncing shared files across all repositories in the PSModule organization. Repositories subscribe to file sets via organization-level custom properties (Type and SubscribeTo), and a scheduled GitHub Actions workflow automatically creates pull requests when managed files change. This is the first pilot release of the service.

• Fixes [MVP] File distribution service to organization repos #1

Convention-based file set structure

File sets are organized under a two-level folder hierarchy at Repos/{Type}/{Selection}/, where each selection folder mirrors the root of a target repository. The folder structure itself is the configuration — no settings files are needed.

The initial release includes file sets for two repository types:

Module (10 file sets): Custom Instructions, Prompts, Hooks, CODEOWNERS, dependabot.yml, PSModule Settings, Linter Settings, gitattributes, gitignore, License

Action (4 file sets): Custom Instructions, License, gitattributes, gitignore

Subscription model

Repositories opt in by setting two organization-level custom properties:

• Type (single-select): Module, Action, Template, Workflow, Docs, Other
• SubscribeTo (multi-select): Names matching the file set folders under the selected type

Repository admins manage their own subscriptions — no central configuration changes are needed to onboard a new repository.

Automated sync workflow

A daily scheduled workflow (also triggerable via workflow_dispatch) authenticates as the PSModule Custo GitHub App, discovers file sets, queries repository subscriptions, and for each subscribing repository:

1. Clones the repo (shallow)
2. Creates a managed-files/update branch
3. Copies subscribed file sets into the clone
4. Commits and pushes only if git detects changes
5. Creates or updates a pull request with static metadata (⚙️ [Maintenance]: Sync managed files, NoRelease label)

Repositories already in sync are skipped entirely. Existing PRs are updated in place via force-push.

GitHub Copilot hooks

The Hooks file set includes a complete GitHub Copilot agent hooks implementation with hooks.json configuration and scripts for sessionStart, sessionEnd, and userPromptSubmitted events (both bash and PowerShell).

What does not change

Files removed from a file set are not deleted from target repositories — they become unmanaged. The service only creates and updates files.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/checkout/git/refs/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/refs/tags/v4 --jq .object.sha (http block)
• https://api.github.com/repos/actions/checkout/git/refs/tags/v4.2.2
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• https://api.github.com/repos/actions/checkout/releases/latest
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/releases/latest --jq .tag_name (http block)
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)