GPT-5 finding
Workflow relies on preinstalled GitHub CLI (gh) without ensuring availability
mediumbuild-releasehigh
- .github/workflows/sync-upstream.yml:70-76
- .github/workflows/sync-upstream.yml:85-89
The job assumes `gh` is present on the runner. While ubuntu-latest currently provides `gh`, this is not guaranteed across all runners or future image updates. If `gh` is unavailable, PR creation/editing will fail, breaking the sync automation.
Recommendation
Add an explicit setup step before usage, for example: - `uses: cli/cli-action@v2` (or the current official action) to install `gh`, or - `sudo apt-get update && sudo apt-get install -y gh` on ubuntu. Alternatively, replace the `gh` usage with a maintained action such as `peter-evans/create-pull-request` to remove the dependency on a preinstalled CLI.