From 699873848ec46360ce2fbf3b46615989d1afec87 Mon Sep 17 00:00:00 2001
From: Ryan <ryantl66@gmail.com>
Date: Sun, 2 Nov 2025 00:56:24 -0400
Subject: [PATCH] release(v1.7.5): retrigger CI bump ensure up to date

---
 .github/workflows/sync-changelog.yml | 33 ++++++++++++++++++----------
 CHANGELOG.md                         |  1 +
 2 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/sync-changelog.yml b/.github/workflows/sync-changelog.yml
index 1ae558f..c81f911 100644
--- a/.github/workflows/sync-changelog.yml
+++ b/.github/workflows/sync-changelog.yml
@@ -5,6 +5,7 @@ on:
   push:
     paths:
       - "CHANGELOG.md"
+  workflow_dispatch: {}
 
 permissions:
   contents: write
@@ -18,7 +19,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout FileRise
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ github.ref }}
@@ -37,6 +39,23 @@ jobs:
             echo "No release(vX.Y.Z) tag in commit message; skipping bump."
           fi
 
+      # Ensure we're on the branch and up to date BEFORE modifying files
+      - name: Ensure clean branch (no local mods), update from remote
+        if: steps.ver.outputs.version != ''
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Be on a named branch that tracks the remote
+          git checkout -B "${{ github.ref_name }}" --track "origin/${{ github.ref_name }}" || git checkout -B "${{ github.ref_name }}"
+          # Make sure the worktree is clean
+          if ! git diff --quiet || ! git diff --cached --quiet; then
+            echo "::error::Working tree not clean before update. Aborting."
+            git status --porcelain
+            exit 1
+          fi
+          # Update branch
+          git pull --rebase origin "${{ github.ref_name }}"
+
       - name: Update public/js/version.js (source of truth)
         if: steps.ver.outputs.version != ''
         shell: bash
@@ -47,16 +66,6 @@ jobs:
           window.APP_VERSION = '${{ steps.ver.outputs.version }}';
           EOF
 
-      - name: Sync with remote (rebase)
-        if: steps.ver.outputs.version != ''
-        shell: bash
-        run: |
-          set -euo pipefail
-          git fetch origin ${{ github.ref_name }}
-          # ensure we're on a local branch that tracks the remote
-          git checkout -B ${{ github.ref_name }} --track origin/${{ github.ref_name }} || git checkout -B ${{ github.ref_name }}
-          git pull --rebase origin ${{ github.ref_name }}
-
       - name: Commit version.js only
         if: steps.ver.outputs.version != ''
         shell: bash
@@ -69,7 +78,7 @@ jobs:
             echo "No changes to commit"
           else
             git commit -m "chore(release): set APP_VERSION to ${{ steps.ver.outputs.version }} [skip ci]"
-            git push origin ${{ github.ref_name }}
+            git push origin "${{ github.ref_name }}"
           fi
 
       - name: Checkout filerise-docker
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1aa7d03..07849c9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 release(v1.7.5): CSP hardening, API-backed previews, flicker-free theming, cache tuning & deploy script (closes #50)
 release(v1.7.5): retrigger CI bump (no code changes)
+release(v1.7.5): retrigger CI bump ensure up to date
 
 ### Security/headers