@krx3d/tizentube2 1.16.30 → 1.30.0

package/.github/workflows/build-standalone-release.yaml

@@ -0,0 +1,305 @@
+# -----------------------------------------------------------------------------
+# Build and release the TizenTube Standalone app (standalone/)
+#
+# WHAT THIS DOES
+# ---------------
+# Builds the userscript + regular DIAL service (needed by the standalone
+# service), then the standalone service itself, then packages and signs
+# standalone/ into a .wgt using Samsung's own Tizen Studio CLI, and publishes
+# it as a GitHub Release.
+#
+# Signing note: this used to sign via tizenjs (an unofficial community
+# packaging tool), which produced a .wgt that installed fine as an *update*
+# to an already-trusted app but was rejected with "invalid certificate
+# chain" on a brand-new app id's *first* install. Comparing against three
+# sibling projects (TizenBrew, TizenBrewInstaller, TizenYouTube) that all
+# install fine as fresh apps: the one thing they share and this build didn't
+# is that they're all packaged with Samsung's own official Tizen Studio CLI
+# (`tizen build-web` + `tizen package`), not tizenjs. TizenYouTube in
+# particular proved this isn't about certificate freshness — it uses the
+# exact same (long-expired) Samsung public sample distributor certificate
+# tizenjs was also falling back to, and still installs fine, because it's
+# packaged with the official tool. So this workflow now matches that same
+# working recipe: install Tizen Studio, configure a certificate profile
+# (author cert from secrets + Samsung's public sample distributor cert,
+# same as TizenYouTube/TizenBrew use), and package with `tizen package`
+# instead of tizenjs.
+#
+# This is entirely separate from build-publish-cleanup.yml (which builds and
+# npm-publishes the regular mod on push to main) — different trigger, no
+# shared state, so it doesn't affect that workflow.
+#
+# WHEN IT RUNS
+# ------------
+# - Automatically, right after "Build, publish and cleanup old npm versions"
+#   (build-publish-cleanup.yml) finishes successfully on main — i.e. once the
+#   userscript's new version has actually been bumped and published to npm.
+#   This keeps the standalone app's version in lockstep with the userscript:
+#   it reads the version build-publish-cleanup.yml just bumped in package.json
+#   and writes that same number into standalone/config.xml before packaging,
+#   rather than tracking its own separate version.
+# - On pushing a tag matching v*.*.* (e.g. v1.0.0)
+# - Manually via "Run workflow" (workflow_dispatch)
+#
+# PREREQUISITES (REQUIRED) — Tizen author certificate
+# -----------------------------------------------------
+# The build needs a Tizen author certificate to sign the .wgt.
+#
+# 1) Install Tizen Studio (or just the Certificate Manager) from
+#    https://developer.tizen.org/development/tizen-studio/download
+#
+# 2) Open Certificate Manager (Tizen Studio → Tools → Certificate Manager,
+#    or run `certificate-manager` directly from the Tizen Studio tools dir).
+#
+# 3) Author tab → "+" → "Create a new author certificate". Fill in a name,
+#    organization/email, and a password — remember this password. This
+#    produces an author.p12 file (Certificate Manager will tell you where
+#    it saved it).
+#
+# 4) Base64-encode the .p12 with NO line wrapping:
+#      Linux/macOS:  base64 -w0 author.p12
+#      Windows (PowerShell):
+#        [Convert]::ToBase64String([IO.File]::ReadAllBytes("author.p12"))
+#
+# 5) Add two repository secrets (GitHub repo → Settings → Secrets and
+#    variables → Actions → New repository secret):
+#      TIZEN_AUTHOR_KEY     = the base64 string from step 4
+#      TIZEN_AUTHOR_KEY_PW  = the certificate password from step 3
+#
+# (The distributor certificate needs no setup — it's Samsung's own public
+# sample certificate, bundled with Tizen Studio and installed automatically
+# by this workflow, same as TizenBrew/TizenYouTube use.)
+#
+# HOW TO TRIGGER A BUILD
+# -----------------------
+# git tag v1.0.0 && git push origin v1.0.0
+# (or use "Run workflow" in the Actions tab for an ad-hoc build)
+# -----------------------------------------------------------------------------
+
+name: Build TizenTube Standalone and Release
+
+on:
+  workflow_run:
+    workflows: ['Build, publish and cleanup old npm versions']
+    types: [completed]
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: 'Release version/tag name (e.g. v1.0.0)'
+        required: false
+
+env:
+  TIZEN_STUDIO_VER: 5.6
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    # Only proceed on a successful npm-publish run that was itself triggered by
+    # a push to main (build-publish-cleanup.yml's job is skipped entirely for
+    # pull_request runs, which can still report an overall "success" — checking
+    # .workflow_run.event too avoids firing off of those). Tag pushes and
+    # manual dispatch always proceed.
+    if: >
+      github.event_name != 'workflow_run' ||
+      (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
+    permissions:
+      contents: write
+    steps:
+      # No explicit ref: default checkout behavior is already correct for every
+      # trigger — workflow_run checks out the default branch's current tip,
+      # push (tag) checks out the tag, workflow_dispatch checks out the branch
+      # it was run from. Pinning to github.event.workflow_run.head_sha (as an
+      # earlier version of this workflow did) is wrong: that's the commit that
+      # *triggered* build-publish-cleanup.yml, not the version-bump commit it
+      # produces partway through its own run — checking that out meant this
+      # workflow read package.json *before* the bump, one version behind.
+      - name: Clone repo with full history and tags
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Record the commit this build is actually based on
+        run: echo "RELEASE_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Determine release version (sync with userscript's package.json)
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ github.event.inputs.release_version }}" ]; then
+            RELEASE_VERSION="${{ github.event.inputs.release_version }}"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            RELEASE_VERSION="${GITHUB_REF#refs/tags/}"
+          elif [ -f package.json ]; then
+            PKG_VER=$(node -p "require('./package.json').version")
+            RELEASE_VERSION="${PKG_VER:+v$PKG_VER}"
+          fi
+
+          if [ -z "${RELEASE_VERSION:-}" ]; then
+            CFG_VER=$(sed -n 's/.*<widget[^>]*version="\([^"]*\)".*/\1/p' standalone/config.xml | head -n1)
+            RELEASE_VERSION="${CFG_VER:+v$CFG_VER}"
+            RELEASE_VERSION="${RELEASE_VERSION:-v0.0.0-${GITHUB_SHA:0:7}}"
+          fi
+          echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
+
+      - name: Sync standalone/config.xml version with the userscript's version
+        run: |
+          set -euo pipefail
+          NEW_VER="${RELEASE_VERSION#v}"
+          CUR_VER=$(sed -n 's/.*<widget[^>]*version="\([^"]*\)".*/\1/p' standalone/config.xml | head -n1)
+          if [ -n "$NEW_VER" ] && [ "$NEW_VER" != "$CUR_VER" ]; then
+            sed -i "0,/<widget /s/version=\"${CUR_VER}\"/version=\"${NEW_VER}\"/" standalone/config.xml
+            echo "standalone/config.xml version: ${CUR_VER} -> ${NEW_VER}"
+          else
+            echo "standalone/config.xml version already ${CUR_VER}, nothing to sync"
+          fi
+
+      - name: Determine app metadata for release notes
+        run: |
+          set -euo pipefail
+          APP_ID=$(sed -n 's/.*<tizen:application[^>]*id="\([^"]*\)".*/\1/p' standalone/config.xml | head -n1)
+          APP_NAME=$(echo "$APP_ID" | sed -n 's/^[^.]*\.\(.*\)$/\1/p')
+          echo "APP_ID=${APP_ID:-unknown}" >> $GITHUB_ENV
+          echo "APP_NAME=${APP_NAME:-unknown}" >> $GITHUB_ENV
+
+      # ----------------------------
+      # Build the regular mod + DIAL service — the standalone service wraps
+      # dist/service.js, so it must exist before the standalone service builds.
+      # ----------------------------
+      - name: Build mods (userScript.js)
+        working-directory: mods
+        run: |
+          set -euo pipefail
+          npm ci
+          npx rollup -c
+
+      - name: Build service (service.js)
+        working-directory: service
+        run: |
+          set -euo pipefail
+          npm ci
+          npx rollup -c
+
+      # ----------------------------
+      # Build the standalone service
+      # ----------------------------
+      - name: Build standalone service
+        working-directory: standalone/service
+        run: |
+          set -euo pipefail
+          npm install
+          npm install -g @vercel/ncc
+          npm run build
+          rm -rf node_modules transpiled
+
+      # ----------------------------
+      # Sign and package the standalone app with Tizen Studio
+      # ----------------------------
+      - name: Download Tizen Studio CLI
+        run: |
+          set -euo pipefail
+          curl -fL -o tizen-installer "https://download.tizen.org/sdk/Installer/tizen-studio_${TIZEN_STUDIO_VER}/web-cli_Tizen_Studio_${TIZEN_STUDIO_VER}_ubuntu-64.bin"
+          chmod +x tizen-installer
+
+      - name: Install Tizen Studio CLI
+        run: |
+          set -euo pipefail
+          ./tizen-installer --accept-license "${GITHUB_WORKSPACE}/tizen-studio"
+          rm ./tizen-installer
+          echo "${GITHUB_WORKSPACE}/tizen-studio/tools/ide/bin" >> $GITHUB_PATH
+
+      - name: Configure certificate profile
+        env:
+          AUTHOR_P12_B64: ${{ secrets.TIZEN_AUTHOR_KEY }}
+          AUTHOR_P12_PASSWORD: ${{ secrets.TIZEN_AUTHOR_KEY_PW }}
+        run: |
+          set -euo pipefail
+          mkdir -p "${GITHUB_WORKSPACE}/tizen-data/keystore/author"
+          mkdir -p "${GITHUB_WORKSPACE}/tizen-data/profile"
+          echo "$AUTHOR_P12_B64" | base64 -d > "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12"
+
+          echo "Author cert encryption before conversion:"
+          openssl pkcs12 -info -in "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -passin env:AUTHOR_P12_PASSWORD -noout 2>&1 | grep -i "pbe\|cipher\|mac" || true
+
+          # Tizen Studio's bundled Java signing tool is old and can fail to read a
+          # PKCS#12 file encrypted with the modern AES-256 cipher OpenSSL 3.x (the
+          # default everywhere since ~2021) uses by default — throwing a generic,
+          # misleading "Invalid password" even when the password is correct. Both
+          # node-forge (what tizenjs used) and modern OpenSSL read AES-256 p12s
+          # fine, so this wouldn't have surfaced until switching to Tizen Studio's
+          # own tooling. Re-encrypt with the older, broadly-compatible cipher
+          # in-place — same password, same cert/key contents, just an older wrapper.
+          openssl pkcs12 -legacy -in "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -out /tmp/author-intermediate.pem -nodes -passin env:AUTHOR_P12_PASSWORD
+          openssl pkcs12 -export -legacy -in /tmp/author-intermediate.pem -passout env:AUTHOR_P12_PASSWORD -out "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -macalg sha1
+          rm -f /tmp/author-intermediate.pem
+
+          echo "Author cert encryption after conversion:"
+          openssl pkcs12 -info -in "${GITHUB_WORKSPACE}/tizen-data/keystore/author/author.p12" -passin env:AUTHOR_P12_PASSWORD -noout 2>&1 | grep -i "pbe\|cipher\|mac" || true
+
+          cp .github/assets/profiles.xml "${GITHUB_WORKSPACE}/tizen-data/profile/profiles.xml"
+          python3 -c "from pathlib import Path; import os; from xml.sax.saxutils import escape; p=Path(os.environ['GITHUB_WORKSPACE'])/'tizen-data/profile/profiles.xml'; t=p.read_text(); t=t.replace('\$GITHUB_WORKSPACE', os.environ['GITHUB_WORKSPACE']).replace('\$KEY_PW', escape(os.environ['AUTHOR_P12_PASSWORD'], {'\"':'&quot;'})); p.write_text(t)"
+
+          tizen cli-config "profiles.path=${GITHUB_WORKSPACE}/tizen-data/profile/profiles.xml"
+
+      - name: Build web app
+        working-directory: standalone
+        run: >
+          tizen build-web
+          -e "service/index.js"
+          -e "service/injector.js"
+          -e "service/bootstrap.js"
+          -e "service/build-service.js"
+          -e "service/package.json"
+          -e "service/package-lock.json"
+          -e "service/node_modules"
+          -e "release"
+
+      - name: Package WGT
+        working-directory: standalone
+        run: |
+          set -euo pipefail
+          tizen package -t wgt -s TizenTubeStandalone -- ./
+          mkdir -p release
+          cp *.wgt release/TizenTube.wgt
+
+      - name: Show Tizen CLI log on failure
+        if: failure()
+        run: |
+          LOG_PATH="${GITHUB_WORKSPACE}/tizen-studio-data/cli/logs/cli.log"
+          if [ -f "$LOG_PATH" ]; then
+            echo "--- tizen cli.log ---"
+            cat "$LOG_PATH"
+          else
+            echo "No cli.log found at $LOG_PATH"
+          fi
+
+      - name: Upload TizenTube Standalone artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: TizenTube-Standalone-${{ env.RELEASE_SHA }}.wgt
+          path: standalone/release/TizenTube.wgt
+
+      # Changelog is built from the PRs merged since the previous published
+      # release; the build/TBI_METADATA header stays first so the TizenBrew
+      # Installer still finds it.
+      - name: Build release notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          bash .github/scripts/build-release-notes.sh             "${{ env.RELEASE_SHA }}"             "${{ env.RELEASE_VERSION }}"             "${{ env.APP_ID }}"             "${{ env.APP_NAME }}"             "$RUNNER_TEMP/release-notes.md"
+
+      - name: Release TizenTube Standalone
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ env.RELEASE_VERSION }}
+          target_commitish: ${{ env.RELEASE_SHA }}
+          body_path: ${{ runner.temp }}/release-notes.md
+          files: |
+            standalone/release/*

package/.github/workflows/claude.yml

@@ -0,0 +1,58 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+
+          # Optional: Customize the trigger phrase (default: @claude)
+          # trigger_phrase: "/claude"
+
+          # Optional: Trigger when specific user is assigned to an issue
+          # assignee_trigger: "claude-bot"
+
+          # Optional: Configure Claude's behavior with CLI arguments
+          # claude_args: |
+          #   --model claude-opus-4-1-20250805
+          #   --max-turns 10
+          #   --allowedTools "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"
+          #   --system-prompt "Follow our coding standards. Ensure all new code has tests. Use TypeScript for new files."
+
+          # Optional: Advanced settings configuration
+          # settings: |
+          #   {
+          #     "env": {
+          #       "NODE_ENV": "test"
+          #     }
+          #   }

package/.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: '23 3 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+          config: |
+            paths-ignore:
+              - dist/**
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"

package/.github/workflows/upstream-sync.yml

@@ -0,0 +1,165 @@
+# Watch reisxd/TizenTube for new commits and open a PR that carries them.
+#
+# This fork has rewritten large parts of mods/ (adblock.js, hideWatched.js,
+# settings.js in particular), so most upstream commits touching those files
+# WILL conflict. The workflow does not pretend otherwise: it always produces a
+# branch that merges cleanly into main, and when a file conflicted it keeps the
+# fork's version and says so in the PR body, so the upstream change can be
+# hand-ported afterwards.
+name: Upstream sync
+
+on:
+  schedule:
+    # 04:20 UTC daily — outside the usual release window.
+    - cron: '20 4 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: upstream-sync
+  cancel-in-progress: false
+
+env:
+  UPSTREAM_REPO: https://github.com/reisxd/TizenTube.git
+  UPSTREAM_BRANCH: main
+  UPSTREAM_BRANCH_REF: upstream/main
+  SYNC_BRANCH: sync/upstream
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Clone repo with full history
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Configure git identity
+        run: |
+          git config user.name  'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+
+      - name: Fetch upstream
+        run: |
+          set -euo pipefail
+          git remote add upstream "$UPSTREAM_REPO" 2>/dev/null || git remote set-url upstream "$UPSTREAM_REPO"
+          git fetch upstream "$UPSTREAM_BRANCH" --no-tags
+
+      - name: Check for new upstream commits
+        id: check
+        run: |
+          set -euo pipefail
+          COUNT=$(git rev-list --count "origin/main..upstream/${UPSTREAM_BRANCH}")
+          echo "count=$COUNT" >> "$GITHUB_OUTPUT"
+          echo "Upstream commits not in main: $COUNT"
+
+      - name: Merge upstream, keeping the fork's side of any conflict
+        id: merge
+        if: steps.check.outputs.count != '0'
+        run: |
+          set -euo pipefail
+          BASE_SHA=$(git rev-parse origin/main)
+          git checkout -B "$SYNC_BRANCH" origin/main
+
+          # --no-commit so the CI-exclusion below lands in the same commit
+          # whether or not the merge conflicted, rather than needing a second.
+          CONFLICTS=""
+          git merge --no-commit --no-ff "$UPSTREAM_BRANCH_REF" || true
+
+          CONFLICTS=$(git diff --name-only --diff-filter=U || true)
+          if [ -n "$CONFLICTS" ]; then
+            # Keep this fork's version of every conflicted file. The point of
+            # the PR is to surface the change for review, not to guess at a
+            # resolution — committing conflict markers would only produce a
+            # branch that cannot build.
+            echo "Conflicted files kept at fork version:"
+            echo "$CONFLICTS"
+            while IFS= read -r f; do
+              [ -z "$f" ] && continue
+              git checkout --ours -- "$f" 2>/dev/null || git rm -q -- "$f"
+              git add -- "$f" 2>/dev/null || true
+            done <<< "$CONFLICTS"
+          fi
+
+          # CI is never synced from upstream, for two reasons. This fork runs
+          # its own workflows (npm publish, standalone .wgt build, this sync)
+          # which have no upstream counterpart, so importing theirs would be
+          # actively wrong. And GITHUB_TOKEN *cannot* push changes under
+          # .github/workflows at all — there is no "workflows" permission in
+          # the permissions: block, that scope exists only for PATs and GitHub
+          # Apps, so a push carrying one is rejected outright:
+          #   refusing to allow a GitHub App to create or update workflow
+          #   `.github/workflows/...` without `workflows` permission
+          # Restoring the directory to exactly origin/main covers both the
+          # modified and the newly-added case.
+          if git rev-parse --verify -q "${BASE_SHA}:.github/workflows" >/dev/null; then
+            git rm -rf --quiet --ignore-unmatch .github/workflows >/dev/null 2>&1 || true
+            git checkout "$BASE_SHA" -- .github/workflows
+            git add -A .github/workflows
+            echo "Restored .github/workflows to the fork's version"
+          fi
+
+          # A clean merge leaves everything staged but uncommitted because of
+          # --no-commit; a conflicted one is staged by the loop above.
+          git commit --no-edit || echo "Nothing to commit"
+
+          {
+            echo 'conflicts<<TT_EOF'
+            echo "$CONFLICTS"
+            echo 'TT_EOF'
+          } >> "$GITHUB_OUTPUT"
+
+          if git diff --quiet origin/main -- .; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            git push --force-with-lease origin "$SYNC_BRANCH"
+          fi
+
+      - name: Open or update the sync PR
+        if: steps.check.outputs.count != '0' && steps.merge.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CONFLICTS: ${{ steps.merge.outputs.conflicts }}
+          NEW_COMMITS: ${{ steps.check.outputs.count }}
+        run: |
+          set -euo pipefail
+
+          {
+            echo "Automated sync with [reisxd/TizenTube](https://github.com/reisxd/TizenTube) — **${NEW_COMMITS}** new upstream commit(s)."
+            echo
+
+            if [ -n "${CONFLICTS//[[:space:]]/}" ]; then
+              echo "## :warning: Needs hand-porting"
+              echo
+              echo "These files conflicted and were **kept at this fork's version**, so the upstream changes to them are *not* in this PR. Merging as-is is safe but incomplete — port them by hand before or after merging:"
+              echo
+              while IFS= read -r f; do
+                [ -z "$f" ] && continue
+                echo "- \`$f\`"
+              done <<< "$CONFLICTS"
+              echo
+            else
+              echo "Merged cleanly — no conflicts."
+              echo
+            fi
+
+            echo "## Upstream commits"
+            echo
+            git log --reverse --no-merges --pretty=format:'- [`%h`](https://github.com/reisxd/TizenTube/commit/%H) %s' "origin/main..upstream/${UPSTREAM_BRANCH}"
+            echo
+            echo
+            echo "_Opened automatically by \`.github/workflows/upstream-sync.yml\`._"
+          } > /tmp/pr-body.md
+
+          EXISTING=$(gh pr list --head "$SYNC_BRANCH" --state open --json number --jq '.[0].number // empty')
+          TITLE="Sync with upstream (${NEW_COMMITS} new commit(s))"
+
+          if [ -n "$EXISTING" ]; then
+            gh pr edit "$EXISTING" --title "$TITLE" --body-file /tmp/pr-body.md
+            echo "Updated PR #$EXISTING"
+          else
+            gh pr create --base main --head "$SYNC_BRANCH" --title "$TITLE" --body-file /tmp/pr-body.md
+          fi