From 69504a7c157ab51b169d2e19a90f0ec72401d6dd Mon Sep 17 00:00:00 2001 From: Aegis AI Assistant Date: Sun, 16 Aug 2026 09:19:38 -0700 Subject: [PATCH] fix: rm -rf before restoring .github/workflows, not just checkout -- MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #58's restoration step (git checkout origin/main -- .github/workflows) looked right but was a no-op for exactly the case that matters: a workflow_dispatch run just failed again with the identical integration_tests.yml rejection. git checkout -- only overwrites paths that already exist in . It doesn't delete files present in the working tree/index but absent from — so a brand-new file the merge just pulled in from upstream (origin/main never had it) survives untouched, and the push still gets rejected for it. Verified locally with a throwaway git sandbox reproducing the exact scenario (origin lacks a file, upstream adds it, merge, restore): without rm -rf first, the restore step produces a zero-diff commit and the new file is still there; with it, the file is correctly staged for deletion and the restore actually restores. --- .github/workflows/upstream-sync.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/upstream-sync.yml b/.github/workflows/upstream-sync.yml index 71f59968b..ca219a07d 100644 --- a/.github/workflows/upstream-sync.yml +++ b/.github/workflows/upstream-sync.yml @@ -45,13 +45,16 @@ jobs: # regardless of the permissions: block above — that restriction is # hard-coded for the default token and isn't a grantable scope (there is # no such thing as a "workflows" permissions key; that error message's - # wording is misleading). Restoring our own workflow files after the - # merge — mirroring mlx-swift's upstream-sync.yml, which already does - # this and has never hit the restriction — keeps the push a pure - # content sync instead of trying to grant a permission that doesn't - # exist. + # wording is misleading). `rm -rf` before restoring is required, not + # optional: `git checkout -- .github/workflows` only overwrites + # paths that already exist in — it leaves a file the merge just + # added (e.g. upstream's integration_tests.yml, which origin/main + # never had) sitting in the working tree untouched, so the push still + # gets rejected for that new file. Verified locally: without the rm, + # this step is a silent no-op for exactly the case that matters. + rm -rf .github/workflows git checkout origin/main -- .github/workflows - git add .github/workflows + git add -A .github/workflows git diff --cached --quiet || git commit -m "chore(sync): restore SharpAI mlx-swift fork dependency after upstream merge" git push -f origin sync/upstream-latest