From c0e7232a646fed548814fab928fe58a6cd6b48ab Mon Sep 17 00:00:00 2001 From: TonyBlu Date: Mon, 25 May 2026 22:29:58 +0800 Subject: [PATCH] fix(ci): require UPSTREAM_TOKEN PAT for fork sync push GITHUB_TOKEN cannot push to fork repos in scheduled workflows. Remove the GITHUB_TOKEN fallback so the workflow fails explicitly when UPSTREAM_TOKEN is missing, instead of silently 403-ing. Also add issues:write permission and git user config for merges. --- .github/workflows/sync-upstream.yml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml index 82c69c1..25c8e56 100644 --- a/.github/workflows/sync-upstream.yml +++ b/.github/workflows/sync-upstream.yml @@ -2,6 +2,7 @@ name: Upstream Sync permissions: contents: write + issues: write on: schedule: @@ -19,7 +20,17 @@ jobs: with: ref: master fetch-depth: 0 - token: ${{ secrets.UPSTREAM_TOKEN || secrets.GITHUB_TOKEN }} + # Must use a PAT with repo scope — GITHUB_TOKEN cannot push in fork scheduled workflows + token: ${{ secrets.UPSTREAM_TOKEN }} + + - name: Check UPSTREAM_TOKEN + run: | + if [ -z "$UPSTREAM_TOKEN" ]; then + echo "::error::UPSTREAM_TOKEN secret is not set. Please add a Personal Access Token with repo scope to your repository secrets." + exit 1 + fi + env: + UPSTREAM_TOKEN: ${{ secrets.UPSTREAM_TOKEN }} - name: Sync upstream changes id: sync @@ -40,6 +51,10 @@ jobs: echo "Upstream: $UPSTREAM" echo "has_changes=true" >> "$GITHUB_OUTPUT" + # Configure git for the merge commit + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + # Try merge first (preserves both histories) if git merge upstream/master --no-edit; then git push origin master