fix: always overwrite workflow files on init so upgrades take effect

The scaffolder used writeIfNotExists for CI workflow files, which meant
re-running `apx init canonical` on an existing repo would silently keep
stale workflows (e.g. the old commit-based on-merge instead of the new
Docker build/push/attest flow). Workflow files are APX-managed templates,
not user-customized files, so they should always be overwritten.

Removes the writeIfNotExists helper entirely — apx.yaml is the only
file that still uses a skip-if-exists guard (it contains user config).

Author: daniel-garcia

internal/schema/app.go

@@ -80,8 +80,9 @@ func (s *AppScaffolder) Generate(baseDir string) error {
 	if err := os.MkdirAll(workflowDir, 0755); err != nil {
 		return fmt.Errorf("failed to create .github/workflows: %w", err)
 	}
+	// Always overwrite so upgrades pick up new templates
 	releasePath := filepath.Join(workflowDir, "apx-release.yml")
-	if err := writeIfNotExists(releasePath, templates.GenerateAppRelease(s.org, "apis")); err != nil {
+	if err := os.WriteFile(releasePath, []byte(templates.GenerateAppRelease(s.org, "apis")), 0644); err != nil {
 		return fmt.Errorf("failed to write apx-release.yml: %w", err)
 	}
 

internal/schema/canonical.go

@@ -77,13 +77,13 @@ func (s *CanonicalScaffolder) Generate(targetDir string) error {
 
 	// Generate catalog/.gitignore so generated catalog data is not committed
 	catalogGitignorePath := filepath.Join(targetDir, "catalog", ".gitignore")
-	if err := writeIfNotExists(catalogGitignorePath, "catalog.yaml\n"); err != nil {
+	if err := os.WriteFile(catalogGitignorePath, []byte("catalog.yaml\n"), 0644); err != nil {
 		return fmt.Errorf("failed to write catalog/.gitignore: %w", err)
 	}
 
 	// Generate catalog/Dockerfile for CI-based container builds
 	dockerfilePath := filepath.Join(targetDir, "catalog", "Dockerfile")
-	if err := writeIfNotExists(dockerfilePath, templates.GenerateCatalogDockerfile(s.org)); err != nil {
+	if err := os.WriteFile(dockerfilePath, []byte(templates.GenerateCatalogDockerfile(s.org)), 0644); err != nil {
 		return fmt.Errorf("failed to write catalog/Dockerfile: %w", err)
 	}
 
@@ -117,26 +117,17 @@ func (s *CanonicalScaffolder) Generate(targetDir string) error {
 		}
 	}
 
-	// Generate CI workflow
+	// Generate CI workflow — always overwrite so upgrades pick up new templates
 	ciPath := filepath.Join(targetDir, ".github", "workflows", "ci.yml")
-	if err := writeIfNotExists(ciPath, templates.GenerateCanonicalCI()); err != nil {
+	if err := os.WriteFile(ciPath, []byte(templates.GenerateCanonicalCI()), 0644); err != nil {
 		return fmt.Errorf("failed to write ci.yml: %w", err)
 	}
 
-	// Generate on-merge workflow
+	// Generate on-merge workflow — always overwrite so upgrades pick up new templates
 	onMergePath := filepath.Join(targetDir, ".github", "workflows", "on-merge.yml")
-	if err := writeIfNotExists(onMergePath, templates.GenerateCanonicalOnMerge(s.org)); err != nil {
+	if err := os.WriteFile(onMergePath, []byte(templates.GenerateCanonicalOnMerge(s.org)), 0644); err != nil {
 		return fmt.Errorf("failed to write on-merge.yml: %w", err)
 	}
 
 	return nil
 }
-
-// writeIfNotExists writes content to path only if the file does not
-// already exist, making scaffolding idempotent.
-func writeIfNotExists(path, content string) error {
-	if _, err := os.Stat(path); err == nil {
-		return nil // already exists — skip
-	}
-	return os.WriteFile(path, []byte(content), 0644)
-}