Upstream Sync Automation (NI -> Org main)

[svelderrainruiz]

Summary

Implement upstream sync automation from ni/labview-for-containers into org main using PR-only flow, with deterministic classification and audit artifacts.

Scope

• Daily + manual sync workflow
• PR-only integration to protected main (no direct pushes)
• Deterministic sync classification + JSON summary artifacts
• Conflict handling with actionable output

Out of Scope

• Any bypass of branch protection
• Image retag/publish logic changes
• 2020 promotion policy changes

Implementation Checklist

• Add .github/workflows/upstream-sync.yml with schedule + workflow_dispatch
• Add dispatch inputs: upstream_ref, sync_mode, pr_base, sync_branch_prefix, dry_run
• Add classification output contract: in_sync, behind_requires_sync_pr, sync_pr_opened, sync_pr_updated, conflict_requires_pr, execution_error
• Emit builds/status/upstream-sync-summary-<timestamp>.json
• Enforce PR-only behavior against protected main
• Ensure idempotency (single open sync PR per upstream ref)
• Add docs/upstream-sync.md runbook and policy text
• Update org AGENTS.md with source-of-truth + mirror policy + drift handling reference

Tracking

• Implementation branch: sync/upstream-automation-v1
• Follow-up PR will reference this issue.

[svelderrainruiz]

Implementation branch: sync/upstream-automation-v1\nPR: #5

[github-actions]

Upstream sync classification: conflict_requires_pr

• Base SHA: 36ed0cde7e10224d01b8222bcde3b10ff013c414
• Upstream SHA: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217
• Sync branch: sync/upstream-main
• PR URL: n/a
• Summary JSON: builds/status/upstream-sync-summary-20260222-044740.json
• Note: origin/main and upstream/main are divergent (non-fast-forward).
• Error: n/a

[github-actions]

Upstream sync classification: conflict_requires_pr

• Base SHA: 36ed0cde7e10224d01b8222bcde3b10ff013c414
• Upstream SHA: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217
• Sync branch: sync/upstream-main
• PR URL: n/a
• Summary JSON: builds/status/upstream-sync-summary-20260222-044757.json
• Note: origin/main and upstream/main are divergent (non-fast-forward).
• Error: n/a

[svelderrainruiz]

Implementation update complete for this iteration.

Merged work:

• PR Add PR-only upstream sync automation #5: Add PR-only upstream sync automation #5
• Main SHA after merge: 36ed0cde7e10224d01b8222bcde3b10ff013c414

What is now in main:

• PR-only upstream sync workflow: .github/workflows/upstream-sync.yml
• Deterministic summary artifact contract: builds/status/upstream-sync-summary-*.json
• Conflict/execution-error tracking issue notifications
• Updated docs runbook: docs/upstream-sync.md
• Updated org policy doc + AGENTS policy refinements
• Monthly drift report now checks upstream-sync runbook and AGENTS policy sections
• Governance audit now checks conversation-resolution policy in addition to existing checks

Runtime evidence (post-merge):

1. Upstream Sync detect-only run Org Integration Hub: 2026-first stabilization execution and evidence tracking #1 (pass)

• https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22270663013
• classification: conflict_requires_pr
• base_sha: 36ed0cde7e10224d01b8222bcde3b10ff013c414
• upstream_sha: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217

2. Upstream Sync detect-only run Org integration hub bootstrap and 2026-first stabilization stack #2 (pass, identical)

• https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22270666228
• classification: conflict_requires_pr
• same base/upstream SHA and sync branch (sync/upstream-main)

3. Monthly Drift Report (pass)

• https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22270688998

4. Governance Audit (currently blocked by token permission)

• https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22270674100
• blocker: Resource not accessible by integration (HTTP 403) on branch protection API access.

Deterministic next fix for governance audit:

• run audit with a repo/org admin PAT provided via a dedicated secret (e.g. GOVERNANCE_AUDIT_TOKEN) and use that token for protection API checks.

[svelderrainruiz]

Governance audit token hardening completed and merged.

PR merged:

• Governance audit: support admin token secret #6
• main SHA: dc19c80526a5e7c60ea8f8fc6c96dfb300cd73ec

What changed:

• governance-audit.yml now supports optional secret GOVERNANCE_AUDIT_TOKEN.
• Fallback to github.token remains.
• Workflow now emits deterministic diagnostics: token source + protection API access + explicit secret guidance on 403.

Validation evidence:

1. Branch validation pass (with secret configured)

• https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22270745209

2. Mainline validation pass

• https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22270983369

Result:

• The previous governance-audit blocker is resolved for this repo configuration.

[github-actions]

Upstream sync classification: conflict_requires_pr

• Base SHA: dc19c8034b10528a59208138520f71a65548f5ce
• Upstream SHA: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217
• Sync branch: sync/upstream-main
• PR URL: n/a
• Summary JSON: builds/status/upstream-sync-summary-20260222-053922.json
• Note: Opened sync PR #.
• Error: n/a

[svelderrainruiz]

Governance audit token simplification is merged.\n\n- PR: https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/pull/7\n- Merge commit: 95ec038\n- Branch validation run: https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22271094563\n- Main validation run: https://github.com/LabVIEW-Community-CI-CD/labview-for-containers/actions/runs/22271349918\n\nBehavior now relies on github.token only. Branch-protection API 403/access restrictions are warning-only; remaining governance checks (issues/labels/templates) stay enforced.

[github-actions]

Upstream sync classification: conflict_requires_pr

• Base SHA: 95ec038725afe52734fe89e1c8578ce1ac649578
• Upstream SHA: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217
• Sync branch: sync/upstream-main
• PR URL: n/a
• Summary JSON: builds/status/upstream-sync-summary-20260223-054617.json
• Note: Opened sync PR #.
• Error: n/a

[github-actions]

Upstream sync classification: conflict_requires_pr

• Base SHA: 95ec038725afe52734fe89e1c8578ce1ac649578
• Upstream SHA: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217
• Sync branch: sync/upstream-main
• PR URL: n/a
• Summary JSON: builds/status/upstream-sync-summary-20260224-054300.json
• Note: Opened sync PR #.
• Error: n/a

[github-actions]

Upstream sync classification: conflict_requires_pr

• Base SHA: 95ec038725afe52734fe89e1c8578ce1ac649578
• Upstream SHA: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217
• Sync branch: sync/upstream-main
• PR URL: n/a
• Summary JSON: builds/status/upstream-sync-summary-20260225-054412.json
• Note: Opened sync PR #.
• Error: n/a

[github-actions]

Upstream sync classification: conflict_requires_pr

• Base SHA: 95ec038725afe52734fe89e1c8578ce1ac649578
• Upstream SHA: 8ef6e33155b5fc3af382fea03f5e08d0bc04e217
• Sync branch: sync/upstream-main
• PR URL: n/a
• Summary JSON: builds/status/upstream-sync-summary-20260226-054236.json
• Note: Opened sync PR #.
• Error: n/a