fix: sync-upstream workflow silently fails to open PRs, leaving fork behind

[SmailG]

Summary

The Sync upstream workflow has reported green on every scheduled run, but main has been stuck on upstream commit e46364b (2026-06-17, cursor#135) while the real upstream is now 14 commits / a month ahead at 3fe2823 (2026-07-14, cursor#156). The workflow never surfaced this because every failure-prone step was wrapped in || true.

Root cause, confirmed from the job logs of run 29565251942:

could not add label: 'sync' not found
no pull requests found for branch "sync/pstack-parity-sweep-with-the-private-skill-tree-156-14-commits"

1. The workflow's permissions: block granted contents: write and pull-requests: write, but not issues: write — which gh label create needs. That call has been failing on every run, invisibly, because it was piped through 2>/dev/null || true.
2. Since the sync label never actually got created (confirmed via the API — sync label does not exist in this repo), the subsequent gh pr create --label sync failed too — also swallowed by || true.
3. Net result: the workflow correctly detects upstream changes, rebases, and force-pushes a sync/* branch every day (see e.g. sync/pstack-parity-sweep-with-the-private-skill-tree-156-14-commits currently in the branch list), but no PR has ever been created — gh pr list --state all returns zero results for this repo. gh pr merge --auto then silently no-ops too. The job exits 0 throughout, so the run shows "success" while nothing actually syncs.

Changes

• Add issues: write to workflow permissions, so label creation actually succeeds.
• Switch gh label create to --force (idempotent update-or-create) instead of swallowing stderr — keeps the "already exists" case silent while letting genuine errors surface.
• After gh pr create, verify a PR actually exists for the branch (gh pr view) and fail the job loudly if not, instead of continuing silently on failure.
• Turn a failed gh pr merge --auto into a visible ::warning:: annotation instead of a silent no-op, in case auto-merge is also disabled at the repo level.

Follow-up for a repo admin

Please double check Settings → General → Pull Requests → "Allow auto-merge" is enabled on this repo. The workflow calls gh pr merge --auto --rebase, and if that setting is off, PRs will now be created correctly but will need to be merged manually (the new warning annotation will call this out in the run logs if it happens).

Test plan

• .github/workflows/sync-upstream.yml YAML parses successfully.
• Once merged, confirm the next scheduled/dispatched run actually opens a PR for the outstanding 14-commit sync and that the sync label is created.
• Confirm the PR either auto-merges or, if auto-merge is disabled repo-wide, that the new warning annotation appears in the run log.

---

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• sync

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: eb252eee-c85e-4ac6-9dfb-3dafe27656b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

.coderabbit.yml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "version"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}