move permissions repo sync to separated action