From c02b41b0cfae9983b6e3bc139f458c14c50f9830 Mon Sep 17 00:00:00 2001
From: Brendan Kellam <brendan@sourcebot.dev>
Date: Mon, 10 Aug 2026 11:07:18 -0700
Subject: [PATCH 1/2] feat: trigger Sourcebot Zoekt sync after merges

---
 .github/workflows/sync-sourcebot.yml | 57 ++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/sync-sourcebot.yml

diff --git a/.github/workflows/sync-sourcebot.yml b/.github/workflows/sync-sourcebot.yml
new file mode 100644
index 000000000..d82eba991
--- /dev/null
+++ b/.github/workflows/sync-sourcebot.yml
@@ -0,0 +1,57 @@
+name: Sync Sourcebot Zoekt Dependency
+
+# This workflow needs base-repository secrets for the cross-repository dispatch.
+# It never checks out or executes pull request code.
+on:
+  pull_request_target:
+    types: [closed]
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.base.ref == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate Sourcebot GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.SOURCEBOT_SYNC_APP_ID }}
+          private-key: ${{ secrets.SOURCEBOT_SYNC_APP_PRIVATE_KEY }}
+          owner: sourcebot-dev
+          repositories: sourcebot
+
+      - name: Request Sourcebot dependency update
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ZOEKT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+          ZOEKT_PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+
+          jq -n \
+            --arg zoekt_sha "$ZOEKT_SHA" \
+            --arg zoekt_pr_number "$ZOEKT_PR_NUMBER" \
+            '{
+              event_type: "zoekt-pr-merged",
+              client_payload: {
+                zoekt_sha: $zoekt_sha,
+                zoekt_pr_number: $zoekt_pr_number
+              }
+            }' \
+            | gh api \
+                --method POST \
+                --header "Accept: application/vnd.github+json" \
+                --header "X-GitHub-Api-Version: 2022-11-28" \
+                --input - \
+                repos/sourcebot-dev/sourcebot/dispatches
+
+          {
+            echo "## Sourcebot sync requested"
+            echo
+            echo "Dispatched Zoekt PR #$ZOEKT_PR_NUMBER at \`$ZOEKT_SHA\`."
+          } >> "$GITHUB_STEP_SUMMARY"

From f4b645ea17855dc3cefcb7daffff9933e5efe7e1 Mon Sep 17 00:00:00 2001
From: Brendan Kellam <brendan@sourcebot.dev>
Date: Mon, 10 Aug 2026 11:23:29 -0700
Subject: [PATCH 2/2] fix: restrict Sourcebot sync token permissions

---
 .github/workflows/sync-sourcebot.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/sync-sourcebot.yml b/.github/workflows/sync-sourcebot.yml
index d82eba991..481bc60f8 100644
--- a/.github/workflows/sync-sourcebot.yml
+++ b/.github/workflows/sync-sourcebot.yml
@@ -24,6 +24,7 @@ jobs:
           private-key: ${{ secrets.SOURCEBOT_SYNC_APP_PRIVATE_KEY }}
           owner: sourcebot-dev
           repositories: sourcebot
+          permission-contents: write
 
       - name: Request Sourcebot dependency update
         env: