🔧 chore(ci): automate thirdparty superpowers refresh and sync base

.gitea/workflows/sync-superpowers.yml

@@ -9,6 +9,7 @@ concurrency:
 
 env:
   WORKSPACE_DIR: "/home/workspace"
+  TARGET_BRANCH: "main"
   SUPERPOWERS_BRANCH: "thirdparty/skill"
   SUPERPOWERS_DIR: "superpowers"
   SUPERPOWERS_LIST: "codex/skills/.sources/superpowers.list"
@@ -51,18 +52,10 @@ jobs:
             cd "$REPO_DIR"
           fi
 
-          TARGET_SHA="${{ github.sha }}"
-          TARGET_REF="${{ github.ref }}"
-          if git cat-file -e "$TARGET_SHA^{commit}" 2>/dev/null; then
-            git checkout -f "$TARGET_SHA"
-          else
-            if [ -n "$TARGET_REF" ]; then
-              git fetch origin "$TARGET_REF"
-              git checkout -f FETCH_HEAD
-            else
-              git checkout -f "${{ github.ref_name }}"
-            fi
-          fi
+          # Always run sync from the latest target branch state.
+          # This prevents stale/manual dispatch refs from using outdated scripts.
+          git fetch origin "${{ env.TARGET_BRANCH }}"
+          git checkout -B "${{ env.TARGET_BRANCH }}" "origin/${{ env.TARGET_BRANCH }}"
 
           git config --global --add safe.directory "$REPO_DIR"
           echo "REPO_DIR=$REPO_DIR" >> $GITHUB_ENV

.gitea/workflows/update-thirdparty-superpowers.yml

@@ -0,0 +1,68 @@
+name: Update Third-party Superpowers
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: thirdparty-superpowers-update-${{ github.repository }}
+  cancel-in-progress: true
+
+env:
+  WORKSPACE_DIR: "/home/workspace"
+  TARGET_BRANCH: "thirdparty/skill"
+  UPSTREAM_REPO: "https://github.com/obra/superpowers.git"
+  UPSTREAM_REF: "main"
+
+jobs:
+  update:
+    name: Update thirdparty/skill snapshot
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Prepare repo
+        run: |
+          echo "========================================"
+          echo "Prepare repo to WORKSPACE_DIR"
+          echo "========================================"
+
+          REPO_NAME="${{ github.event.repository.name }}"
+          REPO_DIR="${{ env.WORKSPACE_DIR }}/$REPO_NAME"
+          TOKEN="${{ secrets.WORKFLOW }}"
+          if [ -n "$TOKEN" ]; then
+            REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${{ github.repository }}.git"
+          else
+            REPO_URL="${GITHUB_SERVER_URL}/${{ github.repository }}.git"
+          fi
+
+          if [ -d "$REPO_DIR" ]; then
+            if [ -d "$REPO_DIR/.git" ]; then
+              cd "$REPO_DIR"
+              git clean -fdx
+              git reset --hard
+              git fetch --all --tags --force --prune --prune-tags
+            else
+              rm -rf "$REPO_DIR"
+            fi
+          fi
+
+          if [ ! -d "$REPO_DIR/.git" ]; then
+            mkdir -p "${{ env.WORKSPACE_DIR }}"
+            git clone "$REPO_URL" "$REPO_DIR"
+            cd "$REPO_DIR"
+          fi
+
+          git fetch origin main
+          git checkout -B main origin/main
+
+          git config --global --add safe.directory "$REPO_DIR"
+          echo "REPO_DIR=$REPO_DIR" >> $GITHUB_ENV
+
+      - name: Update thirdparty/skill snapshot
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd "$REPO_DIR"
+          bash .gitea/ci/update_thirdparty_superpowers.sh