Rebase local commits before pushing to handle PR-branch drift (#763)

The skill step takes 20-45 min. During that window, someone often
pushes merges from main to the PR branch (refreshing against latest
review feedback). When the workflow's final "Commit and push" step
then tries to push its local state, git rejects with:

  ! [rejected] HEAD -> renovate/... (fetch first)
  error: failed to push some refs

Seen on run 24745672604 (skill completed successfully in 14 min,
push rejected at the finish).

Fix:
  - After committing any skill content, fetch the PR branch's
    current tip.
  - If origin is at or ahead of local (no new local commits), skip
    the push entirely. This is the common case when the skill
    produces no content changes.
  - Otherwise rebase local commits onto origin/HEAD_REF so we
    integrate any drift (merges, manual edits) before pushing.
  - Conflicts during rebase fail the step loudly with an
    actionable message.

Same protection applied to the earlier "Commit + push refreshed
reference assets" step; the race window is smaller there but still
non-zero.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rdimitrov

.github/workflows/upstream-release-docs.yml

@@ -367,6 +367,14 @@ jobs:
             echo "No reference changes for $PROJECT_ID $NEW_TAG."
           else
             git commit -m "Refresh reference assets for $PROJECT_ID $NEW_TAG"
+            # Someone may have pushed to HEAD_REF between our checkout
+            # and now (merges from main, etc). Rebase onto the latest
+            # tip before pushing so we don't fail with "fetch first".
+            git fetch origin "$HEAD_REF" --quiet
+            git rebase "origin/$HEAD_REF" || {
+              echo "::error::Rebase of the refresh commit onto origin/$HEAD_REF hit conflicts. Resolve manually on the PR branch."
+              exit 1
+            }
             git push origin "HEAD:$HEAD_REF"
           fi
 
@@ -588,16 +596,30 @@ jobs:
           HEAD_REF: ${{ steps.eff.outputs.head_ref }}
         run: |
           # Stage any skill content and add a content commit if non-empty.
-          # A refresh commit from the earlier step may also be waiting.
           git add -A
           if ! git diff --cached --quiet; then
             git commit -m "Add upstream-release-docs content for $PROJECT_ID $NEW_TAG"
           else
             echo "No skill content changes to commit."
           fi
-          # Push whatever local commits are ahead of the remote — refresh
-          # only, content only, or both. Empty push is a no-op.
-          git push origin "HEAD:$HEAD_REF"
+
+          # Skill can take 20-45 min; during that window someone may
+          # push merges-from-main or other commits to the PR branch.
+          # Handle that safely:
+          #   - If our local HEAD is already on origin (no new work
+          #     to push), exit cleanly.
+          #   - Otherwise rebase any local-only commits onto the
+          #     latest origin tip, then push. Conflicts fail loudly.
+          git fetch origin "$HEAD_REF" --quiet
+          if git merge-base --is-ancestor HEAD "origin/$HEAD_REF" 2>/dev/null; then
+            echo "Origin is at or ahead of local; nothing to push."
+          else
+            git rebase "origin/$HEAD_REF" || {
+              echo "::error::Rebase of local commits onto origin/$HEAD_REF hit conflicts. Resolve manually on the PR branch."
+              exit 1
+            }
+            git push origin "HEAD:$HEAD_REF"
+          fi
 
       - name: Augment PR body (marker-delimited section)
         # Runs even if earlier steps soft-failed so the augmentation