Primary finding
Push step runs even when merge produced no commit, causing the workflow to fail
highbughigh
- .github/workflows/sync-upstream.yml:56-67
On a merge conflict the step runs `git add -A` then `git commit ... --no-verify || true`. If the working tree has nothing stageable that produces a different snapshot (e.g. a delete/delete or rename/rename conflict that resolves to identical content, or `git add -A` failing on a submodule conflict), the commit can fail. The `|| true` swallows that failure, so the workflow proceeds to push a branch whose tip equals an ancestor of upstream/main with no merge commit, or `git push` may succeed but the subsequent `gh pr create --base main --head $BRANCH` will fail with "No commits between main and $BRANCH". More importantly, even when the commit does succeed, conflict markers in tracked text files will be committed — but binary conflicts and submodule conflicts are silently lost. There is no verification that a commit was actually created before pushing.
Recommendation
After the conflict branch, check `git rev-parse HEAD` against the pre-merge SHA (or use `git diff --quiet HEAD@{1} HEAD`) and fail the step explicitly if no commit was produced. Do not swallow the commit failure with `|| true`.