Enhance integration workflow

[opajonk]

Now it tracks commit creation status and amends commits conditionally. Also, it removes temporary files created by the QEMU test startup to avoid them being committed. Also, the created PR is now draft by default.

[Copilot]

Pull request overview

This PR enhances the upstream integration GitHub Actions workflow by tracking whether an integration commit was created during the run and using that information to decide whether to amend an existing commit or create a new one when rewriting devcontainer image tags.

Changes:

• Record INTEGRATION_COMMIT_CREATED in GITHUB_ENV based on whether the integration step produced staged changes.
• Conditionally --amend the prior integration commit only when this run created it; otherwise create a separate “Rewrite devcontainer image tag for PR” commit and push normally.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/scripts/qemu_smoke_test.sh:73

• The cleanup for devcontainer-created files only runs on the success path; if the smoke test times out or errors, .devcontainer/credentials.netrc (potentially containing credentials) is left behind in the workspace. Add an EXIT trap to always remove these files, and keep qemu.log intact on failure for debugging.

    # remove files created during devcontainer run
    rm -f "${workspace_root}/.devcontainer/timezone.env"
    rm -f "${workspace_root}/.devcontainer/credentials.netrc"

.github/workflows/upstream_integration.yml:214

• git push --force-with-lease can fail here because the remote-tracking ref (origin/${INTEGRATION_BRANCH}) is stale after the earlier non-forced push. In the same job, after pushing the integration commit, the local origin/${INTEGRATION_BRANCH} still points to the pre-push commit, so --force-with-lease will reject the amend push. Fetch the branch before the force-with-lease push (or use an explicit lease value) so the lease check reflects the current remote tip.

          elif [[ "${INTEGRATION_COMMIT_CREATED}" == "true" ]]; then
            # Amend the integration commit only when this run created one.
            git commit --amend --no-edit
            git push --force-with-lease origin "HEAD:${INTEGRATION_BRANCH}"
          else

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/upstream_integration.yml:160

• When there are no changes to commit, the workflow does not push the integration branch. If the branch was just created from main (i.e., it didn't exist on origin yet), the subsequent gh pr create --head "${INTEGRATION_BRANCH}" will fail because the head branch doesn't exist on the remote.

          git add -A
          if git diff --cached --quiet; then
            echo "No changes to commit; working copy already matches upstream."
            echo "INTEGRATION_COMMIT_CREATED=false" >> "${GITHUB_ENV}"
          else