From 38566399b0e4b8d1b1e77e9dc8a62da29a70c400 Mon Sep 17 00:00:00 2001
From: Wabo <admin@wabo.cc>
Date: Tue, 2 Jun 2026 10:37:40 -0400
Subject: [PATCH] Fix CI: add bin/sync-upstream to rebrand allowlists, install
 libvips for assets precompile

---
 .github/workflows/ci.yml | 2 ++
 bin/rebrand-check        | 1 +
 bin/rebrand-sync         | 1 +
 3 files changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 06a4301e..516e256a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -142,6 +142,8 @@ jobs:
           bundle config path vendor/bundle
           bundle install --jobs 4 --retry 4
           yarn install
+          sudo apt-get update
+          sudo apt-get install -y libvips
       - name: Precompile assets
         env:
           RAILS_ENV: production
diff --git a/bin/rebrand-check b/bin/rebrand-check
index 5de39212..27c52bdb 100755
--- a/bin/rebrand-check
+++ b/bin/rebrand-check
@@ -52,6 +52,7 @@ ALLOW_FILES = Set.new([
   'app/views/shared/_email_attribution.html.erb',
   'bin/rebrand-sync',
   'bin/rebrand-check',
+  'bin/sync-upstream',
   'lib/wabosign.rb',
   'lib/docuseal.rb',
   # Migration that finds rows by the legacy docuseal_aatl name.
diff --git a/bin/rebrand-sync b/bin/rebrand-sync
index dba5f2f5..c3cc300d 100755
--- a/bin/rebrand-sync
+++ b/bin/rebrand-sync
@@ -49,6 +49,7 @@ DENY_PATHS = Set.new([
   'app/views/shared/_email_attribution.html.erb',
   'bin/rebrand-sync',
   'bin/rebrand-check',
+  'bin/sync-upstream',
   # WaboSign brand logo files — must never be touched by the sweep;
   # restored from ORIG_HEAD by bin/sync-upstream after an upstream merge.
   'public/favicon.svg',