release(v1.7.5): retrigger CI bump ensure up to date

.github/workflows/sync-changelog.yml

@@ -5,6 +5,7 @@ on:
   push:
     paths:
       - "CHANGELOG.md"
+  workflow_dispatch: {}
 
 permissions:
   contents: write
@@ -18,7 +19,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout FileRise
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ github.ref }}
@@ -37,6 +39,23 @@ jobs:
             echo "No release(vX.Y.Z) tag in commit message; skipping bump."
           fi
 
+      # Ensure we're on the branch and up to date BEFORE modifying files
+      - name: Ensure clean branch (no local mods), update from remote
+        if: steps.ver.outputs.version != ''
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Be on a named branch that tracks the remote
+          git checkout -B "${{ github.ref_name }}" --track "origin/${{ github.ref_name }}" || git checkout -B "${{ github.ref_name }}"
+          # Make sure the worktree is clean
+          if ! git diff --quiet || ! git diff --cached --quiet; then
+            echo "::error::Working tree not clean before update. Aborting."
+            git status --porcelain
+            exit 1
+          fi
+          # Update branch
+          git pull --rebase origin "${{ github.ref_name }}"
+
       - name: Update public/js/version.js (source of truth)
         if: steps.ver.outputs.version != ''
         shell: bash
@@ -47,16 +66,6 @@ jobs:
           window.APP_VERSION = '${{ steps.ver.outputs.version }}';
           EOF
 
-      - name: Sync with remote (rebase)
-        if: steps.ver.outputs.version != ''
-        shell: bash
-        run: |
-          set -euo pipefail
-          git fetch origin ${{ github.ref_name }}
-          # ensure we're on a local branch that tracks the remote
-          git checkout -B ${{ github.ref_name }} --track origin/${{ github.ref_name }} || git checkout -B ${{ github.ref_name }}
-          git pull --rebase origin ${{ github.ref_name }}
-
       - name: Commit version.js only
         if: steps.ver.outputs.version != ''
         shell: bash
@@ -69,7 +78,7 @@ jobs:
             echo "No changes to commit"
           else
             git commit -m "chore(release): set APP_VERSION to ${{ steps.ver.outputs.version }} [skip ci]"
-            git push origin ${{ github.ref_name }}
+            git push origin "${{ github.ref_name }}"
           fi
 
       - name: Checkout filerise-docker

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 release(v1.7.5): CSP hardening, API-backed previews, flicker-free theming, cache tuning & deploy script (closes #50)
 release(v1.7.5): retrigger CI bump (no code changes)
+release(v1.7.5): retrigger CI bump ensure up to date
 
 ### Security/headers