chore: sync main into dev

[github-actions]

Automated sync PR to keep dev aligned with main after published releases.

• Release event commit: d096ab3
• Synced main HEAD: d096ab3
• Merge method: merge commit

This PR is managed by CI.

[deepsource-io]

DeepSource Code Review

We reviewed changes in d1077d7...f5d22d7 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Mar 11, 2026 7:42a.m.	Review ↗
Docker		Mar 11, 2026 7:42a.m.	Review ↗
Secrets		Mar 11, 2026 7:42a.m.	Review ↗

[greptile-apps]

Greptile Summary

This is an automated sync PR merging main into dev for release v1.2.8. The substantive changes include refreshed circuit map assets for Shanghai and Albert Park, and a set of CI/CD workflow improvements to make the release → sync pipeline more reliable and auditable.

Key changes:

• release.yml: Release creation now uses a PAT so that the published release event is visible to other workflows (releases created with the default GITHUB_TOKEN do not emit cross-workflow events).
• sync-main-to-dev.yml: Trigger switched from push: branches: [main] to release: types: [published], meaning syncs only happen after an intentional release rather than every direct push to main. Default GITHUB_TOKEN replaces the PAT for checkout, PR creation, and auto-merge steps (permissions are explicitly declared). A new step dispatches ci.yml on the sync branch to produce required check runs, since PRs opened by GITHUB_TOKEN do not auto-trigger pull_request CI. The main SHA at sync time is now recorded in the PR body for traceability.
• CHANGELOG.md: v1.2.8 entry added.
• Binary assets: shanghai.png, tracks_processed/shanghai.bmp, and tracks_spectra6/albert_park.bmp refreshed with updated circuit artwork.

One style concern: the "Enable auto-merge" step runs even if the "Trigger CI" step fails, which could leave the PR in an indefinite waiting state.

Confidence Score: 4/5

• Safe to merge — changes are well-structured with one minor edge-case concern in the CI dispatch / auto-merge ordering.
• The workflow refactoring is logically sound and the permissions model is correctly tightened. The single concern (auto-merge enabled even when CI dispatch fails) is a non-blocking edge case that does not affect the happy path and can be addressed in a follow-up.
• sync-main-to-dev.yml — review the interaction between the "Trigger CI" and "Enable auto-merge" steps.

Important Files Changed

Filename	Overview
.github/workflows/sync-main-to-dev.yml	Refactored trigger (push → release:published), removed SYNC_PAT from most steps in favour of default GITHUB_TOKEN with explicit permissions, added main_sha capture, and added a new CI dispatch step. One concern: auto-merge is enabled even if the CI dispatch step fails, which could leave the PR hanging with no check runs.
CHANGELOG.md	Adds v1.2.8 release entry documenting updated track map assets and the workflow automation improvements. No issues.
app/assets/tracks/shanghai.png	Binary asset update (refreshed Shanghai circuit source map). No code-level concerns.
app/assets/tracks_processed/shanghai.bmp	Binary asset update (regenerated 1-bit BMP from updated Shanghai source). No code-level concerns.
app/assets/tracks_spectra6/albert_park.bmp	Binary asset update (Spectra 6 BMP regenerated from refreshed Albert Park source). No code-level concerns.
.github/workflows/release.yml	Added a PAT token to the release creation step so that the published release event properly triggers the sync workflow. Correct and minimal change.

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant Main as main branch
    participant RW as release.yml
    participant GH as GitHub (Release)
    participant SW as sync-main-to-dev.yml
    participant CI as ci.yml

    Dev->>Main: Push CHANGELOG.md update
    Main->>RW: Triggers (push to main)
    RW->>GH: createRelease() via SYNC_PAT
    GH-->>SW: release:published event
    SW->>SW: git fetch + capture main_sha
    SW->>SW: git merge origin/main → sync/main-to-dev
    SW->>Main: git push sync/main-to-dev
    SW->>GH: Create / update sync PR
    SW->>CI: workflow_dispatch on sync/main-to-dev
    CI-->>GH: Check run posted on sync branch SHA
    SW->>GH: Enable auto-merge on PR
    GH->>GH: Auto-merge when checks pass

Loading

_{Last reviewed commit: f5d22d7}

[greptile-apps]

Auto-merge enabled even if CI trigger fails

The "Enable auto-merge" step runs unconditionally (only gating on has_changes == 'true') regardless of whether the preceding "Trigger CI" step succeeded. If createWorkflowDispatch throws (e.g., transient API error, rate limit), that step will fail, but auto-merge will still be enabled. The PR will then sit indefinitely waiting for a CI check run that never materialises, requiring manual intervention to restart.

Consider adding a condition on the auto-merge step to only run if CI triggering succeeded, or wrapping the dispatch call in a try/catch that falls back gracefully:

- name: Enable auto-merge for sync PR
  if: steps.prepare.outputs.has_changes == 'true' && steps.trigger_ci.outcome == 'success'

This requires setting id: trigger_ci on the preceding step.