fix: address review feedback for PR #896

.github/workflows/sync-internal-docs.yml

@@ -9,9 +9,6 @@ jobs:
   sync:
     name: Bump internal-docs submodule pointer on dev
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
     steps:
       - name: Rewrite SSH submodule URL to HTTPS-with-token
         env:
@@ -21,13 +18,14 @@ jobs:
 
       - uses: actions/checkout@v4
         with:
+          token: ${{ secrets.INTERNAL_DOCS_SYNC_TOKEN }}
           submodules: true
           ref: dev
           fetch-depth: 50
 
-      - name: Open auto-merge PR if internal-docs has new commits
+      - name: Bump submodule pointer if internal-docs has new commits
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.INTERNAL_DOCS_SYNC_TOKEN }}
         run: |
           set -e
 
@@ -44,18 +42,12 @@ jobs:
             exit 0
           fi
 
-          BRANCH="bot/sync-internal-docs-$(date -u +%Y%m%d-%H%M%S)"
           git config user.name  "browseros-bot"
           git config user.email "bot@browseros.ai"
-          git checkout -b "$BRANCH"
           git add .internal-docs
           git commit -m "chore: sync internal-docs submodule"
-          git push -u origin "$BRANCH"
 
-          PR_URL=$(gh pr create \
-            --base dev \
-            --head "$BRANCH" \
-            --title "chore: sync internal-docs submodule" \
-            --body "Automated bump of the \`.internal-docs\` submodule pointer. Auto-merging.")
-
-          gh pr merge "$PR_URL" --auto --squash --delete-branch
+          # Rebase onto latest dev to absorb any commits that landed during the run,
+          # then push. set -e takes care of failing the run on rebase conflict.
+          git pull --rebase origin dev
+          git push origin dev