fix(ci): force version files to match upstream after merge

Git auto-merge can silently pick the wrong side for version/dep files
when both sides modified them. After merge (clean or conflict-resolved),
explicitly checkout version files from upstream tag and create a fixup
commit if any differ. Prevents version string and dependency mismatches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: JOY

.github/workflows/sync-upstream.yml

@@ -62,17 +62,7 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-          # Try clean merge first
-          if git merge "$TAG" --no-edit -m "Merge upstream $TAG"; then
-            echo "result=success" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          # Merge failed — auto-resolve conflicts
-          echo "::notice::Merge conflict detected, attempting auto-resolve..."
-
-          # Strategy: accept upstream (theirs) for version/build files
-          # These are the files that ALWAYS conflict because fork tracks upstream version
+          # Files that MUST match upstream exactly (versions, deps, build config)
           VERSION_FILES=(
             mix.exs
             rel/config.exs
@@ -86,37 +76,63 @@ jobs:
             apps/utils/mix.exs
           )
 
+          # Try clean merge first
+          if git merge "$TAG" --no-edit -m "Merge upstream $TAG"; then
+            echo "Clean merge succeeded"
+          else
+            # Merge failed — auto-resolve conflicts
+            echo "::notice::Merge conflict detected, attempting auto-resolve..."
+
+            for f in "${VERSION_FILES[@]}"; do
+              if git diff --name-only --diff-filter=U | grep -qx "$f"; then
+                echo "  Auto-resolve (theirs): $f"
+                git checkout --theirs "$f"
+                git add "$f"
+              fi
+            done
+
+            # Accept upstream for ALL upstream workflow files (version bumps)
+            # Our custom workflows (docker-publish, deploy-config, sync-upstream) won't conflict
+            CONFLICT_WORKFLOWS=$(git diff --name-only --diff-filter=U | grep '^\.github/workflows/' || true)
+            if [ -n "$CONFLICT_WORKFLOWS" ]; then
+              echo "  Auto-resolve (theirs): workflow files"
+              echo "$CONFLICT_WORKFLOWS" | xargs git checkout --theirs
+              echo "$CONFLICT_WORKFLOWS" | xargs git add
+            fi
+
+            # Check if any conflicts remain
+            REMAINING=$(git diff --name-only --diff-filter=U || true)
+            if [ -n "$REMAINING" ]; then
+              echo "::warning::Unresolvable conflicts in: $REMAINING"
+              git merge --abort
+              echo "result=conflict" >> $GITHUB_OUTPUT
+              echo "conflict_files<<EOF" >> $GITHUB_OUTPUT
+              echo "$REMAINING" >> $GITHUB_OUTPUT
+              echo "EOF" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+
+            git commit --no-edit -m "Merge upstream $TAG (auto-resolved conflicts)"
+          fi
+
+          # Post-merge: ensure version files match upstream EXACTLY
+          # Git auto-merge can silently pick the wrong side for these files
+          FIXUP_NEEDED=false
           for f in "${VERSION_FILES[@]}"; do
-            if git diff --name-only --diff-filter=U | grep -qx "$f"; then
-              echo "  Auto-resolve (theirs): $f"
-              git checkout --theirs "$f"
-              git add "$f"
+            if [ -f "$f" ] && ! diff -q <(git show "$TAG":"$f" 2>/dev/null) "$f" >/dev/null 2>&1; then
+              echo "  Fixup (upstream): $f"
+              git checkout "$TAG" -- "$f"
+              FIXUP_NEEDED=true
             fi
           done
 
-          # Accept upstream for ALL upstream workflow files (version bumps)
-          # Our custom workflows (docker-publish, deploy-config, sync-upstream) won't conflict
-          CONFLICT_WORKFLOWS=$(git diff --name-only --diff-filter=U | grep '^\.github/workflows/' || true)
-          if [ -n "$CONFLICT_WORKFLOWS" ]; then
-            echo "  Auto-resolve (theirs): workflow files"
-            echo "$CONFLICT_WORKFLOWS" | xargs git checkout --theirs
-            echo "$CONFLICT_WORKFLOWS" | xargs git add
+          if [ "$FIXUP_NEEDED" = true ]; then
+            git add -A
+            git commit -m "fixup: restore upstream version files from $TAG"
+            echo "::notice::Version files fixed up to match upstream $TAG"
           fi
 
-          # Check if any conflicts remain
-          REMAINING=$(git diff --name-only --diff-filter=U || true)
-          if [ -z "$REMAINING" ]; then
-            echo "All conflicts auto-resolved!"
-            git commit --no-edit -m "Merge upstream $TAG (auto-resolved version conflicts)"
-            echo "result=success" >> $GITHUB_OUTPUT
-          else
-            echo "::warning::Unresolvable conflicts in: $REMAINING"
-            git merge --abort
-            echo "result=conflict" >> $GITHUB_OUTPUT
-            echo "conflict_files<<EOF" >> $GITHUB_OUTPUT
-            echo "$REMAINING" >> $GITHUB_OUTPUT
-            echo "EOF" >> $GITHUB_OUTPUT
-          fi
+          echo "result=success" >> $GITHUB_OUTPUT
 
       - name: Push and tag
         if: steps.target.outputs.skip == 'false' && steps.merge.outputs.result == 'success'