ci: Fix sync-upstream workflow — auto-resolve version conflicts

- Add auto-resolve strategy: accept upstream (theirs) for version files
  (mix.exs, Makefile, config.exs, CHANGELOG) and workflow files
- Only create PR for actual code conflicts that need manual resolution
- Use GH_PAT secret (fallback GITHUB_TOKEN) for pushing workflow files
- Fix PR base branch: master → main

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: JOY

.github/workflows/sync-upstream.yml

@@ -23,7 +23,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # PAT required to push .github/workflows/ changes
+          # GITHUB_TOKEN cannot modify workflow files
+          token: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
 
       - name: Add upstream remote
         run: |
@@ -60,13 +62,60 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-          # Merge upstream tag into current branch
+          # Try clean merge first
           if git merge "$TAG" --no-edit -m "Merge upstream $TAG"; then
             echo "result=success" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          # Merge failed — auto-resolve conflicts
+          echo "::notice::Merge conflict detected, attempting auto-resolve..."
+
+          # Strategy: accept upstream (theirs) for version/build files
+          # These are the files that ALWAYS conflict because fork tracks upstream version
+          VERSION_FILES=(
+            mix.exs
+            rel/config.exs
+            docker/Makefile
+            CHANGELOG.md
+            apps/block_scout_web/mix.exs
+            apps/ethereum_jsonrpc/mix.exs
+            apps/explorer/mix.exs
+            apps/indexer/mix.exs
+            apps/nft_media_handler/mix.exs
+            apps/utils/mix.exs
+          )
+
+          for f in "${VERSION_FILES[@]}"; do
+            if git diff --name-only --diff-filter=U | grep -qx "$f"; then
+              echo "  Auto-resolve (theirs): $f"
+              git checkout --theirs "$f"
+              git add "$f"
+            fi
+          done
+
+          # Accept upstream for ALL upstream workflow files (version bumps)
+          # Our custom workflows (docker-publish, deploy-config, sync-upstream) won't conflict
+          CONFLICT_WORKFLOWS=$(git diff --name-only --diff-filter=U | grep '^\.github/workflows/' || true)
+          if [ -n "$CONFLICT_WORKFLOWS" ]; then
+            echo "  Auto-resolve (theirs): workflow files"
+            echo "$CONFLICT_WORKFLOWS" | xargs git checkout --theirs
+            echo "$CONFLICT_WORKFLOWS" | xargs git add
+          fi
+
+          # Check if any conflicts remain
+          REMAINING=$(git diff --name-only --diff-filter=U || true)
+          if [ -z "$REMAINING" ]; then
+            echo "All conflicts auto-resolved!"
+            git commit --no-edit -m "Merge upstream $TAG (auto-resolved version conflicts)"
+            echo "result=success" >> $GITHUB_OUTPUT
           else
-            echo "::warning::Merge conflict detected. Creating PR instead."
+            echo "::warning::Unresolvable conflicts in: $REMAINING"
             git merge --abort
             echo "result=conflict" >> $GITHUB_OUTPUT
+            echo "conflict_files<<EOF" >> $GITHUB_OUTPUT
+            echo "$REMAINING" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
           fi
 
       - name: Push and tag
@@ -86,7 +135,7 @@ jobs:
       - name: Create release
         if: steps.target.outputs.skip == 'false' && steps.merge.outputs.result == 'success'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
         run: |
           TAG="${{ steps.target.outputs.tag }}"
           # Delete existing release if any (from upstream fork sync)
@@ -99,34 +148,48 @@ jobs:
       - name: Create PR on conflict
         if: steps.target.outputs.skip == 'false' && steps.merge.outputs.result == 'conflict'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
         run: |
           TAG="${{ steps.target.outputs.tag }}"
           BRANCH="sync-upstream-${TAG}"
 
           git checkout -b "$BRANCH"
           git merge "$TAG" --no-edit || true
 
-          # Stage everything including conflict markers
+          # Auto-resolve what we can (same strategy as above)
+          for f in mix.exs rel/config.exs docker/Makefile CHANGELOG.md apps/*/mix.exs; do
+            if git diff --name-only --diff-filter=U | grep -qx "$f" 2>/dev/null; then
+              git checkout --theirs "$f" && git add "$f"
+            fi
+          done
+          CONFLICT_WF=$(git diff --name-only --diff-filter=U | grep '^\.github/workflows/' || true)
+          [ -n "$CONFLICT_WF" ] && echo "$CONFLICT_WF" | xargs git checkout --theirs && echo "$CONFLICT_WF" | xargs git add
+
           git add -A
           git commit -m "WIP: Merge upstream $TAG (has conflicts)" --no-verify || true
           git push origin "$BRANCH"
 
+          REMAINING=$(echo "${{ steps.merge.outputs.conflict_files }}" | head -20)
           gh pr create \
             --title "Sync upstream $TAG (merge conflicts)" \
             --body "$(cat <<EOF
           ## Upstream Sync - $TAG
 
-          Auto-merge with upstream \`$TAG\` failed due to conflicts.
+          Auto-merge with upstream \`$TAG\` failed. Version/workflow conflicts were auto-resolved,
+          but the following files have code conflicts that need manual resolution:
+
+          \`\`\`
+          $REMAINING
+          \`\`\`
 
           **To resolve:**
           1. Check out this branch locally
-          2. Resolve conflicts
+          2. Resolve remaining conflicts
           3. Push and merge this PR
           4. Then create tag \`$TAG\` to trigger Docker build
 
           [Upstream release notes](https://github.com/blockscout/blockscout/releases/tag/$TAG)
           EOF
           )" \
             --head "$BRANCH" \
-            --base master
+            --base main