uses: ubgo/docsync/integrations/github@main runs ds check --json and, on a pull request, ds github comment: one comment per doc listing that doc's findings, each linked to the doc line, with the block diff folded underneath. Later runs edit the same comments; a doc whose findings cleared is marked resolved. The step exits with the check's code, so a required status blocks the merge on errors.
A reviewer who applies the docs-acked label (input ack-label) makes the run for that labeled event ack every finding on their behalf, credited to their GitHub login, and the action then commits .ds/acks.tsv to the pull request branch with the message docsync: ack findings under the docs-acked label for <login> (input commit-acks, default true). The push needs contents: write and a checkout of the pull request head, which workflows/docsync-pr.yml sets up; with a read-only token the push fails, and with a checkout of the merge commit the step warns and skips. A pull request from a fork is never pushed to: its author records the acks (ds ack … --note '…') and pushes .ds/acks.tsv. A push made after the label is reviewed again, and the label must be re-applied to accept its findings. Pull requests from forks never run --run or --resolve; ds refuses them itself.
The workflows/ directory holds the three jobs from spec §24 ready to copy, all workflow_dispatch: only until their header's triggers are pasted back: pull request, publish after merge (which runs the Go tests through gotestsum to write the JUnit report ds publish --tests reads; swap that step for your own runner's JUnit output in another language), and the nightly scheduled job that alone enables --run and --resolve.