From a85a564ed59ec47c48eee69ec9f00629d04e7a49 Mon Sep 17 00:00:00 2001
From: TonyBlu <zehao100@qq.com>
Date: Mon, 25 May 2026 22:26:01 +0800
Subject: [PATCH 1/2] fix(ci): rewrite sync-upstream workflow to avoid
 third-party actions

Replace actions-cool/issues-helper and aormsby/Fork-Sync-With-Upstream-action
with native git commands and actions/github-script. This fixes the
'Repository access blocked' error caused by GitHub restricting access
to third-party actions in fork repositories.
---
 .github/workflows/sync-upstream.yml | 63 +++++++++++++++++++----------
 1 file changed, 42 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index a74187b..82c69c1 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -2,7 +2,6 @@ name: Upstream Sync
 
 permissions:
   contents: write
-  issues: write
 
 on:
   schedule:
@@ -17,31 +16,53 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-
-      - name: Clean issue notice
-        uses: actions-cool/issues-helper@v3
         with:
-          actions: close-issues
-          labels: "🚨 Sync Fail"
+          ref: master
+          fetch-depth: 0
+          token: ${{ secrets.UPSTREAM_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Sync upstream changes
         id: sync
-        uses: aormsby/Fork-Sync-With-Upstream-action@v3.4
-        with:
-          upstream_sync_repo: alexta69/metube
-          upstream_sync_branch: master
-          target_sync_branch: master
-          target_repo_token: ${{ secrets.UPSTREAM_TOKEN }}
-          test_mode: false
+        run: |
+          git remote add upstream https://github.com/alexta69/metube.git 2>/dev/null || true
+          git fetch upstream master
 
-      - name: Sync check
+          LOCAL=$(git rev-parse HEAD)
+          UPSTREAM=$(git rev-parse upstream/master)
+
+          if [ "$LOCAL" = "$UPSTREAM" ]; then
+            echo "Already up-to-date"
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Local:  $LOCAL"
+          echo "Upstream: $UPSTREAM"
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+
+          # Try merge first (preserves both histories)
+          if git merge upstream/master --no-edit; then
+            git push origin master
+            echo "Merge succeeded"
+            echo "sync_result=success" >> "$GITHUB_OUTPUT"
+          else
+            echo "Merge conflict detected, aborting"
+            git merge --abort
+            echo "sync_result=conflict" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+
+      - name: Sync check — create issue on failure
         if: failure()
-        uses: actions-cool/issues-helper@v3
+        uses: actions/github-script@v7
         with:
-          actions: create-issue
-          title: "🚨 同步失败 | Sync Fail"
-          labels: "🚨 Sync Fail"
-          body: |
-            Due to conflicts or workflow changes in the [alexta69/metube](https://github.com/alexta69/metube) upstream repository, the automatic sync has failed. Please manually sync your fork and resolve any conflicts.
+          script: |
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: "🚨 同步失败 | Sync Fail",
+              labels: ["🚨 Sync Fail"],
+              body: `Due to conflicts or workflow changes in the [alexta69/metube](https://github.com/alexta69/metube) upstream repository, the automatic sync has failed. Please manually sync your fork and resolve any conflicts.
 
-            由于上游仓库 [alexta69/metube](https://github.com/alexta69/metube) 存在冲突或 workflow 变更，自动同步失败。请手动 Sync Fork 并解决冲突。
+            由于上游仓库 [alexta69/metube](https://github.com/alexta69/metube) 存在冲突或 workflow 变更，自动同步失败。请手动 Sync Fork 并解决冲突。`
+            });

From c0e7232a646fed548814fab928fe58a6cd6b48ab Mon Sep 17 00:00:00 2001
From: TonyBlu <zehao100@qq.com>
Date: Mon, 25 May 2026 22:29:58 +0800
Subject: [PATCH 2/2] fix(ci): require UPSTREAM_TOKEN PAT for fork sync push

GITHUB_TOKEN cannot push to fork repos in scheduled workflows.
Remove the GITHUB_TOKEN fallback so the workflow fails explicitly
when UPSTREAM_TOKEN is missing, instead of silently 403-ing.
Also add issues:write permission and git user config for merges.
---
 .github/workflows/sync-upstream.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index 82c69c1..25c8e56 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -2,6 +2,7 @@ name: Upstream Sync
 
 permissions:
   contents: write
+  issues: write
 
 on:
   schedule:
@@ -19,7 +20,17 @@ jobs:
         with:
           ref: master
           fetch-depth: 0
-          token: ${{ secrets.UPSTREAM_TOKEN || secrets.GITHUB_TOKEN }}
+          # Must use a PAT with repo scope — GITHUB_TOKEN cannot push in fork scheduled workflows
+          token: ${{ secrets.UPSTREAM_TOKEN }}
+
+      - name: Check UPSTREAM_TOKEN
+        run: |
+          if [ -z "$UPSTREAM_TOKEN" ]; then
+            echo "::error::UPSTREAM_TOKEN secret is not set. Please add a Personal Access Token with repo scope to your repository secrets."
+            exit 1
+          fi
+        env:
+          UPSTREAM_TOKEN: ${{ secrets.UPSTREAM_TOKEN }}
 
       - name: Sync upstream changes
         id: sync
@@ -40,6 +51,10 @@ jobs:
           echo "Upstream: $UPSTREAM"
           echo "has_changes=true" >> "$GITHUB_OUTPUT"
 
+          # Configure git for the merge commit
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
           # Try merge first (preserves both histories)
           if git merge upstream/master --no-edit; then
             git push origin master