From b830e824e61e3fca1ddb3d7a400f828a9c71a7b2 Mon Sep 17 00:00:00 2001
From: LiHaohua <lihaohua90@gmail.com>
Date: Tue, 21 Jul 2026 22:01:53 +0800
Subject: [PATCH] =?UTF-8?q?chore(workflows):=20keep=20source=20in=20sync?=
 =?UTF-8?q?=20=E2=80=94=20trigger=20update-index=20after=20portal=20auto-m?=
 =?UTF-8?q?erge?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mirror of packages CI fix: after a GITHUB_TOKEN auto-merge (which cannot
trigger the push-based update-index), dispatch update-index explicitly so
the APT index/Pages refresh immediately. Adds actions: write.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 packages-workflows/process-web-submission.yml | 11 ++++++++++-
 packages-workflows/process-web-unpublish.yml  | 10 +++++++++-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/packages-workflows/process-web-submission.yml b/packages-workflows/process-web-submission.yml
index 062cc14..cdb08ab 100644
--- a/packages-workflows/process-web-submission.yml
+++ b/packages-workflows/process-web-submission.yml
@@ -18,6 +18,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  actions: write   # to trigger update-index via workflow_dispatch after auto-merge
 
 env:
   # Set to "false" to require a human maintainer to merge every publish PR.
@@ -305,7 +306,15 @@ jobs:
               "$SUBMITTER" "$VER" "$ARCH" "$WANT_SHA" "$ASSET_NAME" "$DEB_URL" "${{ github.server_url }}" "${{ github.repository }}" "${{ github.run_id }}")")
           echo "url=$PR_URL" >> "$GITHUB_OUTPUT"
           if [ "$AUTO_MERGE" = "true" ]; then
-            gh pr merge "$PR_URL" --squash --delete-branch || echo "::warning::auto-merge failed; awaiting manual review"
+            if gh pr merge "$PR_URL" --squash --delete-branch; then
+              # The merge is pushed with GITHUB_TOKEN, which by design does NOT
+              # trigger the push-based update-index workflow. Kick it off
+              # explicitly (workflow_dispatch is allowed from GITHUB_TOKEN) so the
+              # APT index and Pages reflect the new version right away.
+              gh workflow run update-index.yml --ref main || echo "::warning::could not trigger update-index; run it manually"
+            else
+              echo "::warning::auto-merge failed; awaiting manual review"
+            fi
           fi
 
       - name: Report failure to the submitter
diff --git a/packages-workflows/process-web-unpublish.yml b/packages-workflows/process-web-unpublish.yml
index 9d65345..734e099 100644
--- a/packages-workflows/process-web-unpublish.yml
+++ b/packages-workflows/process-web-unpublish.yml
@@ -18,6 +18,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  actions: write   # to trigger update-index via workflow_dispatch after auto-merge
 
 env:
   AUTO_MERGE: "true"
@@ -82,7 +83,14 @@ jobs:
               --title "unpublish: $PKG $VER (portal request by @$SUBMITTER)" \
               --body "Removal requested by @$SUBMITTER via the developer portal. Ownership verified against the recorded uploader (\`uploaded_by\`).")
             if [ "$AUTO_MERGE" = "true" ]; then
-              gh pr merge "$PR_URL" --squash --delete-branch || echo "::warning::auto-merge failed; awaiting manual review"
+              if gh pr merge "$PR_URL" --squash --delete-branch; then
+                # GITHUB_TOKEN pushes don't trigger the push-based update-index
+                # workflow; dispatch it explicitly so the removal drops from the
+                # APT index right away.
+                gh workflow run update-index.yml --ref main || echo "::warning::could not trigger update-index; run it manually"
+              else
+                echo "::warning::auto-merge failed; awaiting manual review"
+              fi
             fi
           fi
           printf 'errors<<EOM\n%b\nEOM\n' "$ERR" >> "$GITHUB_OUTPUT"