Fix CI: add bin/sync-upstream to rebrand allowlists, install libvips for assets precompile

.github/workflows/ci.yml

@@ -142,6 +142,8 @@ jobs:
           bundle config path vendor/bundle
           bundle install --jobs 4 --retry 4
           yarn install
+          sudo apt-get update
+          sudo apt-get install -y libvips
       - name: Precompile assets
         env:
           RAILS_ENV: production

bin/rebrand-check

@@ -52,6 +52,7 @@ ALLOW_FILES = Set.new([
   'app/views/shared/_email_attribution.html.erb',
   'bin/rebrand-sync',
   'bin/rebrand-check',
+  'bin/sync-upstream',
   'lib/wabosign.rb',
   'lib/docuseal.rb',
   # Migration that finds rows by the legacy docuseal_aatl name.

bin/rebrand-sync

@@ -49,6 +49,7 @@ DENY_PATHS = Set.new([
   'app/views/shared/_email_attribution.html.erb',
   'bin/rebrand-sync',
   'bin/rebrand-check',
+  'bin/sync-upstream',
   # WaboSign brand logo files — must never be touched by the sweep;
   # restored from ORIG_HEAD by bin/sync-upstream after an upstream merge.
   'public/favicon.svg',