Fix weekly upstream sync agentic workflow prompt

Rewrite the prompt from documentation-style to clear imperative
instructions. The agent previously misinterpreted the documentation
as instructions to perform the merge itself (invoking the
agentic-merge-upstream skill), then failed because it couldn't
push code from the sandbox.

The new prompt:
- Gives explicit step-by-step instructions
- Provides bash commands for upstream change detection
- Directs the agent to use safe-output tools (create_issue,
  close_issue, assign_to_agent, noop)
- Explicitly prohibits invoking skills, editing files, or pushing code

Only the markdown content changed; frontmatter is unchanged so no
lock file recompilation is needed.

Agent-Logs-Url: https://github.com/github/copilot-sdk-java/sessions/945e9454-9363-45bc-b281-0fe3d6c87019

Co-authored-by: brunoborges <129743+brunoborges@users.noreply.github.com>

Author: Copilot

.github/workflows/weekly-upstream-sync.md

@@ -41,111 +41,77 @@ safe-outputs:
   noop:
     report-as-issue: false
 ---
-# Weekly Upstream Sync Agentic Workflow
-This document describes the `weekly-upstream-sync.yml` GitHub Actions workflow, which automates the detection of new changes in the official [Copilot SDK](https://github.com/github/copilot-sdk) and delegates the merge work to the Copilot coding agent.
+# Weekly Upstream Sync
 
-## Overview
+You are an automation agent that detects new upstream changes and creates GitHub issues. You do **NOT** perform any code merges, edits, or pushes. Do **NOT** invoke any skills (especially `agentic-merge-upstream`). Your only job is to check for changes and use safe-output tools to create or close issues.
 
-The workflow runs on a **weekly schedule** (every Monday at 10:00 UTC) and can also be triggered manually. It does **not** perform the actual merge — instead, it detects upstream changes and creates a GitHub issue assigned to `copilot`, instructing the agent to follow the [agentic-merge-upstream](../prompts/agentic-merge-upstream.prompt.md) prompt to port the changes.
+## Instructions
 
-The agent must also create the Pull Request with the label `upstream-sync`. This allows the workflow to track the merge progress and avoid creating duplicate issues if the agent is still working on a previous sync.
+Follow these steps exactly:
 
-## Trigger
+### Step 1: Read `.lastmerge`
 
-| Trigger | Schedule |
-|---|---|
-| `schedule` | Every Monday at 10:00 UTC (`0 10 * * 1`) |
-| `workflow_dispatch` | Manual trigger from the Actions tab |
+Read the file `.lastmerge` in the repository root. It contains the SHA of the last upstream commit that was merged into this Java SDK.
 
-## Workflow Steps
+### Step 2: Check for upstream changes
 
-### 1. Checkout repository
+Clone the upstream repository and compare commits:
 
-Checks out the repo to read the `.lastmerge` file, which contains the SHA of the last upstream commit that was merged into the Java SDK.
-
-### 2. Check for upstream changes
-
-- Reads the last merged commit hash from `.lastmerge`
-- Clones the upstream `github/copilot-sdk` repository
-- Compares `.lastmerge` against upstream `HEAD`
-- If they match: sets `has_changes=false`
-- If they differ: counts new commits, generates a summary (up to 20 most recent), and sets outputs (`commit_count`, `upstream_head`, `last_merge`, `summary`)
-
-### 3. Close previous upstream-sync issues (when changes found)
-
-**Condition:** `has_changes == true`
+```bash
+LAST_MERGE=$(cat .lastmerge)
+git clone --quiet https://github.com/github/copilot-sdk.git /tmp/gh-aw/agent/upstream
+cd /tmp/gh-aw/agent/upstream
+UPSTREAM_HEAD=$(git rev-parse HEAD)
+```
 
-Before creating a new issue, closes any existing open issues with the `upstream-sync` label. This prevents stale issues from accumulating when previous sync attempts were incomplete or superseded. Each closed issue receives a comment explaining it was superseded.
+If `LAST_MERGE` equals `UPSTREAM_HEAD`, there are **no new changes**. Go to Step 3a.
 
-### 4. Close stale upstream-sync issues (when no changes found)
+If they differ, count the new commits and generate a summary:
 
-**Condition:** `has_changes == false`
+```bash
+COMMIT_COUNT=$(git rev-list --count "$LAST_MERGE".."$UPSTREAM_HEAD")
+SUMMARY=$(git log --oneline "$LAST_MERGE".."$UPSTREAM_HEAD" | head -20)
+```
 
-If the upstream is already up to date, closes any lingering open `upstream-sync` issues with a comment noting that no changes were detected. This handles the case where a previous issue was created but the changes were merged manually (updating `.lastmerge`) before the agent completed.
+Go to Step 3b.
 
-### 5. Create issue and assign to Copilot
+### Step 3a: No changes detected
 
-**Condition:** `has_changes == true`
+1. Search for any open issues with the `upstream-sync` label using the GitHub MCP tools.
+2. If there are open `upstream-sync` issues, close each one using the `close_issue` safe-output tool with a comment: "No new upstream changes detected. The Java SDK is up to date. Closing."
+3. Call the `noop` safe-output tool with message: "No new upstream changes since last merge (<LAST_MERGE>)."
+4. **Stop here.** Do not proceed further.
 
-Creates a new GitHub issue with:
+### Step 3b: Changes detected
 
-- **Title:** `Upstream sync: N new commits (YYYY-MM-DD)`
-- **Label:** `upstream-sync`
-- **Assignee:** `copilot`
-- **Body:** Contains commit count, commit range links, a summary of recent commits, and a link to the merge prompt
+1. Search for any open issues with the `upstream-sync` label using the GitHub MCP tools.
+2. Close each existing open `upstream-sync` issue using the `close_issue` safe-output tool with a comment: "Superseded by a newer upstream sync check."
+3. Create a new issue using the `create_issue` safe-output tool with:
+   - **Title:** `Upstream sync: <COMMIT_COUNT> new commits (<YYYY-MM-DD>)`
+   - **Body:** Include the following information:
+     ```
+     ## Automated Upstream Sync
 
-The Copilot coding agent picks up the issue, creates a branch and PR, then follows the merge prompt to port the changes.
+     There are **<COMMIT_COUNT>** new commits in the [official Copilot SDK](https://github.com/github/copilot-sdk) since the last merge.
 
-### 6. Summary
+     - **Last merged commit:** [`<LAST_MERGE>`](https://github.com/github/copilot-sdk/commit/<LAST_MERGE>)
+     - **Upstream HEAD:** [`<UPSTREAM_HEAD>`](https://github.com/github/copilot-sdk/commit/<UPSTREAM_HEAD>)
 
-Writes a GitHub Actions step summary with:
+     ### Recent upstream commits
 
-- Whether changes were detected
-- Commit count and range
-- Recent upstream commits
-- Link to the created issue (if any)
+     ```
+     <SUMMARY>
+     ```
 
-## Flow Diagram
+     ### Instructions
 
-```
-┌─────────────────────┐
-│  Schedule / Manual  │
-└──────────┬──────────┘
-           │
-           ▼
-┌─────────────────────┐
-│ Read .lastmerge     │
-│ Clone upstream SDK  │
-│ Compare commits     │
-└──────────┬──────────┘
-           │
-     ┌─────┴─────┐
-     │           │
-  changes?     no changes
-     │           │
-     ▼           ▼
-┌──────────┐  ┌──────────────────┐
-│ Close old│  │ Close stale      │
-│ issues   │  │ issues           │
-└────┬─────┘  └──────────────────┘
-     │
-     ▼
-┌──────────────────────────┐
-│ Create issue assigned to │
-│ copilot                  │
-└──────────────────────────┘
-     │
-     ▼
-┌──────────────────────────┐
-│ Agent follows prompt to  │
-│ port changes → PR        │
-└──────────────────────────┘
-```
+     Follow the [agentic-merge-upstream](.github/prompts/agentic-merge-upstream.prompt.md) prompt to port these changes to the Java SDK.
+     ```
+4. After creating the issue, use the `assign_to_agent` safe-output tool to assign Copilot to the newly created issue.
 
-## Related Files
+## Important constraints
 
-| File | Purpose |
-|---|---|
-| `.lastmerge` | Stores the SHA of the last merged upstream commit |
-| [agentic-merge-upstream.prompt.md](../prompts/agentic-merge-upstream.prompt.md) | Detailed instructions the Copilot agent follows to port changes |
-| `.github/scripts/upstream-sync/` | Helper scripts used by the merge prompt |
+- **Do NOT edit any files**, create branches, or push code.
+- **Do NOT invoke any skills** such as `agentic-merge-upstream` or `commit-as-pull-request`.
+- **Do NOT attempt to merge or port upstream changes.** That is done by a separate agent that picks up the issue you create.
+- You **MUST** call at least one safe-output tool (`create_issue`, `close_issue`, `noop`, etc.) before finishing.