upstream-sync.yml

name: Upstream sync

# Keeps one PR open (branch `upstream-sync`) that brings this copy up to the
# latest release of the upstream HealthSamurai/interbox-workspace; see "Track
# upstream releases" in README.md. On by default in every copy: set the
# repository variable INTERBOX_UPSTREAM_SYNC=off to turn it off. A no-op in the
# upstream repo itself.

on:
  schedule:
    - cron: "23 4 * * *" # daily; off the top of the hour, when GitHub delays scheduled runs most
  workflow_dispatch:

permissions: {}

concurrency:
  group: upstream-sync

jobs:
  sync:
    if: |
      !(github.server_url == 'https://github.com' &&
        github.repository == 'HealthSamurai/interbox-workspace') &&
      vars.INTERBOX_UPSTREAM_SYNC != 'off'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write # push the upstream-sync branch
      pull-requests: write # open/update the PR and its labels
      issues: write # the fallback issue when the branch can't be pushed or the PR opened
    env:
      BUN_VERSION: 1.4.3 # bun.lock needs Bun 1.4+; same pin as azure-pipelines/
    steps:
      # From npm rather than a third-party action, and before checkout, so
      # nothing but first-party code runs while the write token is around.
      - run: npm install -g "bun@$BUN_VERSION"
      # Tag, not SHA: the workflow token can't push workflow changes, so every
      # SHA bump would mean a manual sync in every copy.
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0 # finding the last synced release walks history
      # The CLI is the version bun.lock pins (integrity-checked), so it only
      # changes when a sync PR is merged.
      - run: bun install --frozen-lockfile --ignore-scripts
      - run: ./node_modules/.bin/interbox workspace sync --platform github --into "$DEFAULT_BRANCH"
        env:
          # A schedule event has no repository payload; it always runs on the default branch.
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch || github.ref_name }}
          GH_TOKEN: ${{ github.token }}
          INTERBOX_UPSTREAM_URL: ${{ vars.INTERBOX_UPSTREAM_URL }}