fix: start CI on sync PRs when a person marks them ready (#27)

Assisted-by: Claude Opus 5.5 (1M context)

Author: ipasechnikov

.github/workflows/ci.yml

@@ -4,9 +4,10 @@ on:
   push:
     branches: [main]
   pull_request:
-  # upstream-sync.yml dispatches this on its branch: pushes made with
-  # GITHUB_TOKEN start no push/pull_request runs.
-  workflow_dispatch:
+    # ready_for_review: upstream-sync PRs open as drafts, and a person marking
+    # one ready is what starts CI on it (runs the workflow token starts don't
+    # count as checks on a pull request).
+    types: [opened, synchronize, reopened, ready_for_review]
 
 # Read-only, and checkouts don't keep the token: no job here pushes.
 permissions:

.github/workflows/upstream-sync.yml

@@ -30,8 +30,6 @@ jobs:
       issues: write # the fallback issue when the branch can't be pushed or the PR opened
     env:
       BUN_VERSION: 1.4.3 # bun.lock needs Bun 1.4+; same pin as azure-pipelines/
-    outputs:
-      dispatch-ci: ${{ steps.sync.outputs.dispatch-ci }}
     steps:
       # From npm rather than a third-party action, and before checkout, so
       # nothing but first-party code runs while the write token is around.
@@ -44,25 +42,9 @@ jobs:
       # The CLI is the version bun.lock pins (integrity-checked), so it only
       # changes when a sync PR is merged.
       - run: bun install --frozen-lockfile --ignore-scripts
-      - id: sync
-        run: ./node_modules/.bin/interbox workspace sync --platform github --into "$DEFAULT_BRANCH"
+      - run: ./node_modules/.bin/interbox workspace sync --platform github --into "$DEFAULT_BRANCH"
         env:
           # A schedule event has no repository payload; it always runs on the default branch.
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch || github.ref_name }}
           GH_TOKEN: ${{ github.token }}
           INTERBOX_UPSTREAM_URL: ${{ vars.INTERBOX_UPSTREAM_URL }}
-
-  # Pushes made with GITHUB_TOKEN start no workflow runs, so CI on the sync
-  # branch is dispatched here, from a job that holds nothing else.
-  dispatch-ci:
-    needs: sync
-    # !cancelled(): the CLI writes dispatch-ci even when it fails after pushing.
-    if: ${{ !cancelled() && needs.sync.outputs.dispatch-ci == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: write
-    steps:
-      - run: gh workflow run ci.yml --ref upstream-sync --repo "$GITHUB_REPOSITORY"
-        env:
-          GH_TOKEN: ${{ github.token }}

README.md

@@ -171,9 +171,9 @@ dependencies and its own suite; see its README.
 
 In a copy of this repo, a daily job keeps one PR open from the `upstream-sync`
 branch that brings `main` up to the latest upstream release. Set the variable
-`INTERBOX_UPSTREAM_SYNC=off` to stop it. If the PR
-includes a release with breaking changes, it opens as a draft labelled
-`breaking-change`, with the upgrade notes in its description.
+`INTERBOX_UPSTREAM_SYNC=off` to stop it. When the PR includes a release with
+breaking changes, it is labelled `breaking-change` and lists the upgrade notes
+in its description.
 
 A release that changes CI definitions for the job's own platform, such as
 `.github/workflows/` on GitHub or `azure-pipelines/` on Azure, is never pushed
@@ -206,6 +206,12 @@ the pipeline can only rebuild a branch it created.
   require the `test` and `simulator` checks, block force pushes and deletion,
   and give GitHub Actions no bypass.
 
+The PR opens as a draft, and CI starts when you mark it ready for review.
+GitHub doesn't count checks from runs that the workflow token starts, so this
+is the run your required checks wait for. When the job pushes a newer release
+to the branch, the PR goes back to draft. In a repo without draft PRs it opens
+ready instead; close and reopen it to start CI.
+
 Optional repository variables: `INTERBOX_UPSTREAM_SYNC=off` turns the job off,
 and `INTERBOX_UPSTREAM_URL` points it at another upstream.
 
@@ -231,5 +237,7 @@ and `INTERBOX_UPSTREAM_URL` points it at another upstream.
   requestors can't approve their own changes, the most recent pusher can't
   approve, and votes reset on new pushes.
 
+Here a release with breaking changes opens as a draft PR.
+
 The same two variables work as pipeline variables. Define them as not settable
 at queue time.