Open a repair PR when the release sync hits conflicts

[David Pine (IEvangelist)]

Summary

Update Release Branch currently fails on every push to main once a merge into release/X.Y has a real conflict that the helper can't auto-resolve (e.g. runs 38433783235 and 38436114463 on component-props.contracts.ts). It stays red until someone notices and repairs the branch by hand.

• The merge helper now exits 3 for "conflicts need human review" (merge aborted, release untouched) instead of a generic failure.
• A new --commit-conflicts mode commits the merge with conflict markers left in the unresolved files, keeping both parents, and writes the conflicted paths to $RELEASE_SYNC_CONFLICTS_FILE.
• On exit 3 the workflow pushes a rolling release-sync/X.Y branch and opens a draft PR into release/X.Y that lists the conflicts and the "Create a merge commit, never squash" instructions. The run finishes green with a warning and summary link.
• Before doing any work, the workflow checks for an open PR from release-sync/X.Y. If one exists it skips the sync, so pushes to main no longer repeat the same failure while a human resolves it. After the repair merges, the next push resumes syncing.
• The app token now requests pull-requests: write (already granted for update-integration-data.yml).

Non-conflict failures (push rejection, fatal git errors) still fail the job as before. This is independent of #1701 (push-race retry) and #1666 (version config conflicts) and composes with them.

Third-party links and affiliations

None

Validation

• bash .github/scripts/test-merge-main-into-release.sh: all cases pass, including new exit-code 3, --commit-conflicts with conflicts, and --commit-conflicts on a clean merge.
• bash -n on the three workflow run blocks (extracted from the YAML): passed.
• prettier --check on the workflow: passed after --write.
• Dry run against the real origin/release/17.0 and origin/main in a temporary worktree: the default mode aborts with exit 3, and --commit-conflicts produces a two-parent merge listing src/frontend/tests/typecheck/component-props.contracts.ts with a clean working tree.
• Not run: the workflow end-to-end (PR creation and the skip check need Actions with the app token).

[Copilot]

🟡 Changes recommended

Repair detection is spoofable, while non-marker conflicts can be silently resolved and validation bypassed.

4 open findings

• Handle modify/delete and binary conflicts without silently choosing a side · New
• Run cached checks on all paths except explicitly unresolved conflicts · New
• Match PR head repository owner to avoid trusting fork branches · New
• Suppress standalone recovery guidance during workflow probe runs · New

What changed in this PR

Automates human repair when release synchronization encounters unresolved conflicts.

Changes:

• Adds conflict-specific helper behavior and exit code.
• Opens and tracks draft repair PRs.
• Expands merge-helper regression tests.

File	Description
.github/​workflows/​update-release-branch.yml	Detects and creates repair PRs.
.github/​scripts/​merge-main-into-release.sh	Commits conflicts for review.
.github/​scripts/​test-merge-main-into-release.sh	Tests new helper behavior.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aspire-repo-bot]

Frontend HTML artifact ready

The latest frontend build uploaded the frontend-dist artifact for PR #1883. Use the VS Code button below to open this PR with GitHub Artifacts Explorer and browse the built HTML locally.

This comment updates automatically when a new frontend build artifact is uploaded.