fix(sync-actions): create tag when no changes; tag merge commit when PR merges

[Copilot]

"Create tag" was gated on changed == 'true', so tags were never created on no-op syncs. When a PR was created, the tag pointed to the sync branch HEAD instead of the merge commit on main.

Changes

• Condition: Removed && steps.create-pr.outputs.changed == 'true' from the "Create tag" step — tag is now created regardless of whether a PR was needed.
• Correct commit: When a PR was merged, fetch and reset to origin/main before tagging so the tag lands on the merge commit, not the stale branch HEAD:

  git fetch origin main
  git checkout -B main origin/main

[Copilot]

Pull request overview

Updates the sync-actions GitHub Actions workflow to create tags after syncing actions from github/gh-aw, including logic to tag the merge result rather than the sync branch.

Changes:

• Adjusts the “Create tag” step condition to run when should_create_tag is true.
• Adds logic to fetch and checkout main before tagging when a sync PR was created/merged.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Tagging by checking out origin/main after the PR merge can tag the wrong commit if other commits land on main between the merge and this step. To ensure the tag points to the sync PR’s merge commit, capture the PR’s mergeCommit SHA (e.g., via gh pr view) and checkout/tag that specific SHA instead of origin/main HEAD.

Suggested change

	# When a PR was created and merged, we need to pull the merge commit from main
	# because the working directory is still on the sync branch.
	if [[ "${{ steps.create-pr.outputs.changed }}" == "true" ]]; then
	echo "PR was merged — fetching main to tag the merge commit..."
	git fetch origin main
	git checkout -B main origin/main
	# When a PR was created and merged, we need to tag the merge commit for that PR
	# rather than whatever commit happens to be at the tip of main when this step runs.
	if [[ "${{ steps.create-pr.outputs.changed }}" == "true" ]]; then
	echo "PR was merged — resolving merge commit SHA to tag..."
	PR_NUMBER="${{ steps.create-pr.outputs.pr_number }}"
	if [[ -z "$PR_NUMBER" ]]; then
	echo "Error: PR number not available; cannot determine merge commit to tag." >&2
	exit 1
	fi
	# Ensure gh is authenticated. Prefer an existing GH_TOKEN/GITHUB_TOKEN if set.
	if [[ -z "${GH_TOKEN:-}" && -n "${GITHUB_TOKEN:-}" ]]; then
	export GH_TOKEN="$GITHUB_TOKEN"
	fi
	MERGE_COMMIT_SHA="$(gh pr view "$PR_NUMBER" --json mergeCommit --jq '.mergeCommit.oid')"
	if [[ -z "$MERGE_COMMIT_SHA" || "$MERGE_COMMIT_SHA" == "null" ]]; then
	echo "Error: Could not determine merge commit SHA for PR #$PR_NUMBER." >&2
	exit 1
	fi
	echo "Fetching and checking out merge commit $MERGE_COMMIT_SHA for PR #$PR_NUMBER..."
	git fetch origin
	git checkout "$MERGE_COMMIT_SHA"

[Copilot]

The Create tag step now runs whenever should_create_tag == 'true', even when steps.create-pr.outputs.changed is false. Since the script force-deletes and re-creates the annotated tag, re-running the workflow with no file changes will still rewrite the tag object (and may trigger downstream automation). Consider either restoring the changed == 'true' guard, or making tag creation idempotent by skipping delete/recreate when the existing tag already points to the intended commit.