fix: gh CLI was targeting upstream/cursor/plugins instead of this fork

[SmailG]

Summary

Follow-up to #1. After that fix merged and the workflow was manually re-run (run 29622408659), it failed hard — which is what #1's changes were meant to do when something is genuinely broken, and something was:

Run gh label create sync \
HTTP 403: Resource not accessible by integration (https://api.github.com/repos/cursor/plugins/labels)
Error: Process completed with exit code 1.

Note the URL: api.github.com/repos/cursor/plugins/labels — gh was operating on the upstream repo, not SmailG/claude-cursor-plugins.

Root cause

This job runs git remote add upstream https://github.com/cursor/plugins.git to fetch upstream's history for the rebase. gh's implicit repository resolution (used whenever a command omits --repo) infers the target repo from git remotes, and it prefers a remote literally named upstream over origin — a convention aimed at the common "fork now, PR upstream later" workflow. Since this repo's automation remote is named exactly upstream, every unscoped gh call in this workflow — gh label create, gh pr list, gh pr close, gh pr create, gh pr merge — has been silently targeting cursor/plugins instead of this fork, where the job's GITHUB_TOKEN has (correctly) zero access. That's the actual reason label/PR creation has never worked, going back to the original lag report; #1's permissions/error-surfacing fix was necessary but not sufficient, since the token permissions were only ever wrong for a repo gh should never have touched in the first place.

Fix

Set GH_REPO: ${{ github.repository }} as a job-level env var, so every gh invocation in every step is unambiguously pinned to SmailG/claude-cursor-plugins regardless of which git remotes exist. Pure git commands (git fetch upstream, git rebase upstream/main, etc.) are untouched since GH_REPO only affects the gh CLI.

Test plan

• YAML parses successfully.
• Once merged, trigger the workflow (schedule or workflow_dispatch) and confirm gh label create succeeds against SmailG/claude-cursor-plugins and a real sync PR appears.
• Confirm the PR either auto-merges or produces the ::warning:: annotation from fix: sync-upstream workflow silently fails to open PRs, leaving fork behind #1 if "Allow auto-merge" is off for the repo.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• sync

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: 06583e61-0f3d-4e19-b028-cab8ee80a780

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

.coderabbit.yml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "version"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}