[codex] harden upstream sync workflow

[Clarit-AI]

What changed

• add issues: write so label and issue API calls succeed
• make sync branch names unique per workflow run
• configure git committer identity before creating the merge commit
• bootstrap labels before creating the conflict-report issue

Why

The current main copy of upstream-sync.yml is active, but it still has the same functional issues flagged in PR #18. Those issues can break label creation, misclassify a missing git identity as a merge conflict, and fail on reruns or conflict-report issue creation.

Impact

This makes the scheduled upstream sync workflow safer to run on Clarit-AI/Engram and preserves the intended behavior:

• clean, low-risk syncs open a PR and enable GitHub auto-merge
• medium/high-risk syncs still require manual review
• merge failures create a labeled issue reliably

Validation

• git diff --check
• Ruby YAML parse of .github/workflows/upstream-sync.yml
• inspected live GitHub workflow/PR state for Clarit-AI/Engram

Notes

The workflow itself does not start a Claude session. It fetches sgl-project/sglang, attempts a merge into a generated branch, classifies risk, opens a PR or issue, and auto-merges only low-risk clean sync PRs.

Summary by CodeRabbit

• Chores
  • Enhanced upstream synchronization workflow with unique branch naming per run and improved merge commit handling.
  • Strengthened sync failure tracking with automatic issue label management.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7bf5f386-073f-4bac-ba8c-8823dbc81ea0

📥 Commits

Reviewing files that changed from the base of the PR and between 06cd29d and e87e0b5.

📒 Files selected for processing (1)

• .github/workflows/upstream-sync.yml

---

📝 Walkthrough

Walkthrough

This PR updates the upstream-sync GitHub Actions workflow to enhance merge handling. Changes include granting issues: write permission, making branch names unique per run using GITHUB_RUN_ID, setting git author identity for merge commits, and refactoring label creation to ensure required labels exist before creating merge-failure issues.

Changes

Cohort / File(s)	Summary
Upstream Sync Workflow .github/workflows/upstream-sync.yml	Added issues: write permission; made merge-branch naming unique per run with ${GITHUB_RUN_ID}; configured git author identity for merge commits; refactored label creation flow to verify and construct required labels before creating merge-failure issues, replacing hardcoded label arrays with computed variables.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Poem

🐰 A sync branch now bears a unique name,
With labels checked before the blame,
Git author set, permissions true,
The workflow works anew! 🎉

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-upstream-sync-workflow

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}