Use SYNC_TOKEN PAT so sync can push upstream workflow files

GITHUB_TOKEN is a GitHub Apps installation token and cannot push
branches containing .github/workflows/ changes regardless of the
permissions block. A classic PAT with repo + workflow scopes is
required. Add one as a secret named SYNC_TOKEN.

Author: trevorgowing

.github/workflows/teal-sync-upstream-release.yml

@@ -3,6 +3,9 @@ name: Sync Upstream Metabase Release
 # Monitors metabase/metabase for new releases daily and syncs them into master.
 # - Clean merge: pushed to master automatically.
 # - Merge conflicts: branch pushed + PR opened for manual resolution.
+#
+# Requires a secret named SYNC_TOKEN: a classic PAT with repo + workflow scopes.
+# GitHub Apps tokens (GITHUB_TOKEN) cannot push branches containing workflow files.
 
 on:
   schedule:
@@ -16,17 +19,14 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-      workflows: write
 
     steps:
       - name: Checkout fork
         uses: actions/checkout@v4
         with:
           ref: master
           fetch-depth: 0
-          # If master has branch protection requiring a PAT, set a SYNC_TOKEN secret
-          # and replace secrets.GITHUB_TOKEN here and in the GH_TOKEN env vars below.
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.SYNC_TOKEN }}
 
       - name: Configure git identity
         run: |
@@ -36,7 +36,7 @@ jobs:
       - name: Fetch latest upstream release tag
         id: upstream
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}
         run: |
           TAG=$(gh api repos/metabase/metabase/releases/latest --jq '.tag_name')
           if [[ -z "$TAG" || "$TAG" == "null" ]]; then
@@ -103,12 +103,12 @@ jobs:
           git checkout master
           git merge "$BRANCH" --ff-only
           git push origin master
-          echo "::notice::✅ Synced $TAG to master automatically."
+          echo "::notice::Synced $TAG to master automatically."
 
       - name: Open conflict-resolution PR
         if: steps.status.outputs.result == 'needs-sync' && steps.merge.outputs.outcome == 'conflicts'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}
           CONFLICTS: ${{ steps.merge.outputs.conflicts }}
         run: |
           TAG="${{ steps.upstream.outputs.tag }}"
@@ -161,15 +161,15 @@ jobs:
           OUTCOME="${{ steps.merge.outputs.outcome }}"
 
           if   [[ "$RESULT" == "already-synced" ]]; then
-            echo "### ✅ Already up to date" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Already up to date" >> "$GITHUB_STEP_SUMMARY"
             echo "$TAG is already in master — no action taken." >> "$GITHUB_STEP_SUMMARY"
           elif [[ "$RESULT" == "pr-open" ]]; then
-            echo "### ⏳ PR already open" >> "$GITHUB_STEP_SUMMARY"
+            echo "### PR already open" >> "$GITHUB_STEP_SUMMARY"
             echo "A sync branch for $TAG already exists. Check open PRs." >> "$GITHUB_STEP_SUMMARY"
           elif [[ "$OUTCOME" == "clean" ]]; then
-            echo "### ✅ Synced automatically" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Synced automatically" >> "$GITHUB_STEP_SUMMARY"
             echo "$TAG was merged cleanly into master." >> "$GITHUB_STEP_SUMMARY"
           elif [[ "$OUTCOME" == "conflicts" ]]; then
-            echo "### ⚠️ Conflicts — PR opened" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Conflicts — PR opened" >> "$GITHUB_STEP_SUMMARY"
             echo "$TAG has merge conflicts. A PR has been opened for manual resolution." >> "$GITHUB_STEP_SUMMARY"
           fi