Repository navigation
Daily upstream sync, package-style: only commits 7 days on upstream's main - #2
Merged
Merged
Conversation
…seen A daily GitHub Actions job (.github/workflows/upstream-sync.yml) runs .github/upstream-sync/sync.sh. It records each upstream head with the time it was first seen on the branch upstream-sync-state, and merges into main the newest recorded commit that was first seen at least 7 days ago and is still on upstream's main. The merge driver fork-manifest (.gitattributes) and a check after each merge keep the version fields of the plugin manifests deleted. The job uses plain git and jq, no third-party actions. Pull requests that change these files run test.sh and a dry run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ays again seen.tsv is now a log of upstream's head: a row whenever the head differs from the last row's commit, even if that commit is in an earlier row. The candidate is the newest row at least 7 days old whose commit is an ancestor of every later row's commit, so it stayed in upstream's history without a break. A commit that a force-push removed and that came back later counts only from its new row. As with a package manager's minimum release age, a commit that upstream reverts instead of removing is still merged on day 7; the README says so. Rows must be in time order. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s activity log - Upstream commits that touch .github/ or .gitattributes (adds, edits, mode changes, symbolic links) are never merged automatically: the run fails and asks for a hand merge. A second check compares the merge result with main. So upstream can never change the job's scripts, workflow or merge driver. The check after a failed push is gone. - Before merging, the job reads GitHub's activity log of upstream's main. A force-push or deletion of main after the candidate's row blocks the merge; if the head is still the last row's commit, it is logged again. If the log cannot be read, the run fails without merging. - The run fails when upstream's main no longer has a commit that the fork merged, and when an upstream commit has waited 30 days. - seen.tsv must end with a newline. - test.sh: the fake fork carries the real sync files and workflow, and its hook models GitHub's rule as checked on 2026-10-28 (a new commit must not change .github/workflows/ compared with its first parent). New cases cover the checks above, a clock behind the last row, and merges on top of earlier sync merges. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A daily GitHub Actions job that merges upstream (Crazytieguy/codex-plugin-cc) into this fork's
main, package-style, as npm'smin-release-agedoes: only the newest upstream commit that has been on upstream'smainwithout a break for at least 7 days. Every machine that installs this plugin updates itself frommain, so the delay is a defense against supply-chain attacks..github/upstream-sync/README.mddescribes the rule, the failure cases and how to merge by hand.seen.tsvon the branchupstream-sync-statelogs upstream's head whenever it changes; commit dates are never used. GitHub's activity log of upstream'smainholds a merge back after a force-push or branch deletion..github/or.gitattributesare never merged automatically (so upstream cannot change the job); those merges are done by hand from a machine whose token may push workflow files.versiondeleted from the plugin manifests.test.shand a dry run.After merging: run the workflow once by hand (
gh workflow run upstream-sync.yml -R TruthfulAI-research/codex-plugin-cc, not a dry run) to check the push token, and check that the schedule is enabled (gh workflow list -R TruthfulAI-research/codex-plugin-cc).Tests:
bash .github/upstream-sync/test.sh.🤖 Generated with Claude Code