From b52dd1d3c58ea7001b004d1b4180f81bef0cc29d Mon Sep 17 00:00:00 2001
From: SatoshiQaziMuhammed <info@pezkuwichain.io>
Date: Sun, 13 Sep 2026 17:42:57 +0400
Subject: [PATCH] Open an issue when the daily sync fails at any step (#6)

* fix(sync): open an issue when any step fails, not only when the sync refuses

A failed check, commit or push used to end the job red and nothing else. A
sync that stops without anyone told is how these lists went eight months
stale, so any failure now opens (or comments on) the same issue a refusal
does.

* fix(sync): use the committed GitHub host keys as they are

pezkuwi/github_host_keys already names github.com on every line. The push
step prefixed it again, ssh read "github.com github.com ssh-ed25519 ..." as a
parse error, found no host key, and would have refused every push the sync
made.
---
 .github/workflows/sync-upstream.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index 351ccf1cc..3f798e631 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -73,20 +73,23 @@ jobs:
           umask 077
           printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/sync_deploy
           # GitHub's own host keys, committed in pezkuwi/github_host_keys: nothing learned at run time.
-          sed 's|^|github.com |' pezkuwi/github_host_keys > ~/.ssh/known_hosts
+          # The file already names the host on each line; adding it again made ssh reject every key.
+          cp pezkuwi/github_host_keys ~/.ssh/known_hosts
           GIT_SSH_COMMAND="ssh -i $HOME/.ssh/sync_deploy -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
             git push git@github.com:pezkuwichain/phishing.git HEAD:master
           rm -f ~/.ssh/sync_deploy
 
+      # Also when a later step failed, a refused push included: a sync that stops silently is how
+      # these lists went eight months stale.
       - name: Ask a person
-        if: steps.sync.outputs.rc != '0'
+        if: failure() || steps.sync.outputs.rc != '0'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           title="Upstream list sync stopped and needs a person"
-          body="$(printf 'The daily sync refused to write the lists.\n\n```\n%s\n```\n\nRun: %s/%s/actions/runs/%s\n' \
-            "$(tail -n 40 sync.out)" "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID")"
+          body="$(printf 'The daily sync did not bring the lists up to date: it refused them, or a later step (the checks, the commit, the push) failed.\n\n```\n%s\n```\n\nRun: %s/%s/actions/runs/%s\n' \
+            "$(tail -n 40 sync.out 2>/dev/null || echo 'no sync output')" "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID")"
           open="$(gh issue list --state open --search "in:title \"$title\"" --json number --jq '.[0].number // empty')"
           if [ -n "$open" ]; then gh issue comment "$open" --body "$body"; else gh issue create --title "$title" --body "$body"; fi
           exit 1