fix(ci): switch upstream-sync to PR mode + token preflight - #11
Merged
Conversation
The previous implementation used `gh repo sync`, which:
* has no chance of working against the forks because the PRFirst
branch ruleset (no bypass) blocks all direct pushes to master and
maintenance/gramps60 — `gh repo sync` calls the merge-upstream API,
which is just a fast-forward push under the covers and is rejected
by branch protection.
* could not handle divergence anyway; the forks regularly carry
cherry-picked CI/CD work (see e.g. eduralph/addons-source#16) and
`gh repo sync` refuses to operate on any branch that has commits
upstream lacks.
The new workflow does what the manual sync PRs have been doing by hand:
clones the fork, fetches upstream, attempts a merge commit on a stable
`sync/upstream-<branch>-auto` branch, force-pushes that branch, and
opens (or updates by force-push) a PR against the protected branch.
Conflicts abort cleanly with a file list so the next run after a
manual sync re-attempts from the current head.
Also added an explicit FORK_SYNC_TOKEN preflight check so the failure
mode for a missing token is a single readable line of setup
instructions instead of `gh: To use GitHub CLI in a GitHub Actions
workflow, set the GH_TOKEN environment variable` exit-code 4 from
deep inside `gh repo sync`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`git checkout <branch>` errors with "matched multiple remote tracking branches" when both origin and upstream carry the branch and no local branch exists yet. That happened on every non-default branch — for gramps the default is master so maintenance/gramps60 failed; for addons-source the default is maintenance/gramps60 so master failed. Force the local branch creation from origin/<branch> explicitly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
`gh repo sync` calls GitHub's merge-upstream API, which is a fast-forward push under the covers. The fork ruleset rejects it, and it can't handle the divergent state the forks normally carry. Net effect: the nightly sync has been silently failing for at least 3 days (confirmed by `gh run list --workflow=upstream-sync.yml`), the forks drifted 100+ commits behind upstream, and the QuiltView E2E test in PR #10 needed a manual sync PR (eduralph/addons-source#16) to validate.
Behaviour
For each (repo, branch) matrix cell:
Requirements
Test plan
🤖 Generated with Claude Code