fix: bump sync-from-upstream tools and change base branch behavior

.github/workflows/sync-from-upstream.yaml

@@ -36,23 +36,27 @@ jobs:
         with:
           fetch-depth: 0
       - name: Prepare update branch
+        env:
+          UPDATE_BRANCH: ${{ inputs.update_branch }}
+          UPSTREAM_BRANCH: ${{ github.ref_name }}
         run: |
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config user.name "github-actions[bot]"
           git fetch origin
 
-          # Use the existing remote branch if present; otherwise create from main
-          if git ls-remote --exit-code --heads origin "${{ inputs.update_branch }}" > /dev/null 2>&1; then
-            git checkout --track "origin/${{ inputs.update_branch }}"
+          # Base the update branch on the whole upstream (renovate) branch, not just
+          # vendir.yml. Reuse the existing update branch if present so we don't discard
+          # changes already pushed to it; otherwise create it from the renovate branch.
+          if git ls-remote --exit-code --heads origin "${UPDATE_BRANCH}" > /dev/null 2>&1; then
+            git checkout --track "origin/${UPDATE_BRANCH}"
+            # Merge the whole renovate branch in. On conflict prefer the upstream side
+            # (only vendir.yml realistically conflicts; our derived files do not).
+            git merge --no-edit -X theirs "origin/${UPSTREAM_BRANCH}"
           else
-            git checkout main
-            git checkout -b "${{ inputs.update_branch }}"
+            git checkout -b "${UPDATE_BRANCH}" "origin/${UPSTREAM_BRANCH}"
           fi
 
-          git checkout "origin/${{ github.ref_name }}" -- vendir.yml
-          git add vendir.yml
-          git diff --cached --quiet || git commit -m "chore: update vendir.yml from upstream"
-          git push origin "${{ inputs.update_branch }}"
+          git push origin "${UPDATE_BRANCH}"
 
   call-update-chart:
     needs: prepare-update-branch
@@ -110,7 +114,7 @@ jobs:
             -e GIT_CONFIG_COUNT=1 \
             -e GIT_CONFIG_KEY_0=safe.directory \
             -e GIT_CONFIG_VALUE_0=/github/workspace \
-            gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.5 \
+            gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.6 \
             --show-git-diff \
             --diff-base origin/main \
             --chart-dir /github/workspace/${{ steps.chart.outputs.chart_dir }} \
@@ -132,11 +136,11 @@ jobs:
           fi
           docker run --rm \
             -v ${{ github.workspace }}:/github/workspace \
-            gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.5 \
+            gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.6 \
             --chart-dir /github/workspace/${{ steps.chart.outputs.chart_dir }} \
             "${config_args[@]}"
       - name: Run schema-gen
-        uses: docker://gsoci.azurecr.io/giantswarm/shield-schema-gen:0.0.5
+        uses: docker://gsoci.azurecr.io/giantswarm/shield-schema-gen:0.0.6
         with:
           args: --chart-dir /github/workspace/${{ steps.chart.outputs.chart_dir }}
       - name: Detect dependency version changes
@@ -226,7 +230,7 @@ jobs:
           if [[ ${#args[@]} -gt 0 ]]; then
             docker run --rm \
               -v ${{ github.workspace }}:/workspace \
-              gsoci.azurecr.io/giantswarm/shield-changelogger:0.0.5 \
+              gsoci.azurecr.io/giantswarm/shield-changelogger:0.0.6 \
               --changelog-path /workspace/CHANGELOG.md \
               "${args[@]}"
           fi

CHANGELOG.md

@@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-07-23
+
+### Changed
+
+- `sync-from-upstream.yaml` — bumped the `shield-values-sync`, `shield-schema-gen`, and `shield-changelogger` tool images to `0.0.6`.
+- `sync-from-upstream.yaml` — the update branch is now based on the *entire* upstream (Renovate) branch instead of cherry-picking only `vendir.yml`. `prepare-update-branch` merges the whole renovate branch into `update_branch` (preferring the upstream side on conflict), so non-`vendir.yml` changes made on that branch are carried into the sync PR while changes already on `update_branch` are preserved.
+
 ## 2026-07-22
 
 ### Fixed