From 9d79939d5a5614064cd960bd74ee02db8f1db5f7 Mon Sep 17 00:00:00 2001
From: Lalatendu Mohanty <lmohanty@redhat.com>
Date: Thu, 3 Sep 2026 18:19:23 -0400
Subject: [PATCH] fix(ci): use PR instead of direct push for feature branch
 sync

The sync workflow failed because `new-resolver-config` is a protected
branch that requires changes through pull requests. Instead of pushing
directly, create a PR from an intermediary `sync/` branch. If an open
sync PR already exists, update it in place.

Co-Authored-By: Claude <claude@anthropic.com>
Signed-off-by: Lalatendu Mohanty <lmohanty@redhat.com>
---
 .github/workflows/sync-feature-branch.yaml | 24 ++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-feature-branch.yaml b/.github/workflows/sync-feature-branch.yaml
index 51a8f286..7588f8e3 100644
--- a/.github/workflows/sync-feature-branch.yaml
+++ b/.github/workflows/sync-feature-branch.yaml
@@ -23,6 +23,7 @@ jobs:
     permissions:
       contents: write
       issues: write
+      pull-requests: write
     env:
       TARGET_BRANCH: ${{ inputs.target_branch || 'new-resolver-config' }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -61,9 +62,28 @@ jobs:
             echo "DELIM" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Push merged changes
+      - name: Push merged changes via PR
         if: steps.merge.outputs.result == 'merged'
-        run: git push origin "HEAD:${TARGET_BRANCH}"
+        run: |
+          SYNC_BRANCH="sync/${TARGET_BRANCH}-from-main"
+          git push origin "HEAD:${SYNC_BRANCH}" --force
+          EXISTING_PR=$(gh pr list \
+            --head "$SYNC_BRANCH" \
+            --base "$TARGET_BRANCH" \
+            --state open \
+            --json number \
+            --jq '.[0].number // empty')
+          if [ -n "$EXISTING_PR" ]; then
+            echo "Updated existing sync PR #${EXISTING_PR}"
+          else
+            gh pr create \
+              --head "$SYNC_BRANCH" \
+              --base "$TARGET_BRANCH" \
+              --title "Sync ${TARGET_BRANCH} with main" \
+              --body "Automated merge of \`main\` into \`${TARGET_BRANCH}\`.
+
+          **Workflow run:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          fi
 
       - name: Close resolved sync-conflict issues
         if: steps.merge.outputs.result == 'merged' || steps.merge.outputs.result == 'up-to-date'