ci(codeapi): automate merged public PR imports

.github/workflows/open-sync-pr.yml

@@ -12,6 +12,10 @@ permissions:
   contents: read
   pull-requests: write
 
+concurrency:
+  group: open-sync-pr
+  cancel-in-progress: false
+
 jobs:
   open-pr:
     runs-on: ubuntu-latest
@@ -22,7 +26,9 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          OPEN=$(gh pr list --head sync/main --base main --state open --json number --jq length)
+          OPEN=$(gh api -X GET repos/ClickHouse/code-interpreter/pulls \
+            -f state=open -f base=main -f head=ClickHouse:sync/main \
+            -f per_page=1 --jq length)
           if [ "$OPEN" -gt 0 ]; then
             echo "Sync PR already open."
             exit 0

CONTRIBUTING.md

@@ -5,20 +5,20 @@ Thanks for your interest in Code Interpreter!
 ## How this repository is maintained
 
 This repository is published from an internal ClickHouse monorepo, which is
-the source of truth. Every change that lands internally is mirrored here as a
-snapshot commit on the `sync/main` branch (spot them by the
-`Source: ClickHouse/ai@<sha>` trailer); a maintainer merges the resulting
-sync pull request to release it to `main`.
+the source of truth. Internal changes that are not already public are mirrored
+here as a snapshot commit on the `sync/main` branch (spot them by the
+`Source: ClickHouse/ai@<sha>` trailer); a maintainer merges the resulting sync
+pull request to release it to `main`.
 
 Practical consequences:
 
-- **Pull requests are welcome.** CI runs on every PR. A maintainer reviews
-  your change, imports it into the internal repository, and it arrives back
-  with the next sync PR. We preserve attribution with a `Co-authored-by:`
-  trailer — your PR will be closed with a reference to the sync that
-  contains it.
-- **`main` accepts no direct pushes.** It only advances by merging sync pull
-  requests; branch rules enforce this with no exceptions.
+- **Pull requests are welcome.** CI runs on every PR. After a maintainer merges
+  your change here, an automated bridge opens a matching internal pull request
+  from the exact landed range. The internal review and CI gates still apply,
+  and attribution is preserved with a `Co-authored-by:` trailer.
+- **`main` accepts no direct pushes.** It advances through reviewed community
+  pull requests and automated sync pull requests; branch rules enforce this
+  with no exceptions.
 - **History is snapshot-based.** Commits here intentionally do not mirror the
   internal commit history.