diff --git a/.github/workflows/sync-doc-pr-zh-to-en.yml b/.github/workflows/sync-doc-pr-zh-to-en.yml
index af8b4db17d612..a407128c87b14 100644
--- a/.github/workflows/sync-doc-pr-zh-to-en.yml
+++ b/.github/workflows/sync-doc-pr-zh-to-en.yml
@@ -20,7 +20,12 @@ on:
         options:
           - deepseek
           - gemini
-        default: 'gemini'
+          - openai
+        default: 'openai'
+
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
   sync-docs:
@@ -67,6 +72,13 @@ jobs:
           TARGET_OWNER=$(echo "$TARGET_URL" | cut -d'/' -f4)
           TARGET_REPO=$(echo "$TARGET_URL" | cut -d'/' -f5)
           TARGET_PR=$(echo "$TARGET_URL" | cut -d'/' -f7)
+
+          if [[ "$SOURCE_OWNER/$SOURCE_REPO" != "pingcap/docs-cn" ]]; then
+            echo "❌ Unsupported source repository: only pingcap/docs-cn is supported"; exit 1
+          fi
+          if [[ "$TARGET_OWNER/$TARGET_REPO" != "pingcap/docs" ]]; then
+            echo "❌ Unsupported target repository: only pingcap/docs is supported"; exit 1
+          fi
           
           {
             echo "source_owner<<EOF"; echo "$SOURCE_OWNER"; echo "EOF"
@@ -109,10 +121,12 @@ jobs:
 
       - name: Run sync script
         id: sync_script
+        continue-on-error: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEEPSEEK_API_TOKEN: ${{ secrets.DEEPSEEK_API_TOKEN }}
           GEMINI_API_TOKEN: ${{ secrets.GEMINI_API_TOKEN }}
+          OPENAI_API_TOKEN: ${{ secrets.OPENAI_API_TOKEN }}
           SOURCE_PR_URL: ${{ github.event.inputs.source_pr_url }}
           TARGET_PR_URL: ${{ github.event.inputs.target_pr_url }}
           AI_PROVIDER: ${{ github.event.inputs.ai_provider }}
@@ -156,9 +170,11 @@ jobs:
           TARGET_REPO: ${{ steps.extract_info.outputs.target_repo }}
           TARGET_PR: ${{ steps.extract_info.outputs.target_pr }}
         run: |
-          BODY=$(printf '%s\n\n%s\n%s\n%s\n\n%s' "**Auto-sync completed successfully**" \
-            "**Source PR**: ${SOURCE_PR_URL}" "**Target PR**: ${TARGET_PR_URL}" \
-            "English documentation has been updated based on Chinese documentation changes." )
+          BODY=$(printf '%s\n\n%s\n%s\n\n%s' \
+            "**Auto-sync completed successfully**" \
+            "**Source PR**: ${SOURCE_PR_URL}" \
+            "**Target PR**: ${TARGET_PR_URL}" \
+            "English documentation has been updated based on Chinese documentation changes.")
           PAYLOAD=$(jq -n --arg body "$BODY" '{body: $body}')
           curl -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
             -H "Accept: application/vnd.github.v3+json" \
@@ -166,7 +182,7 @@ jobs:
             -d "$PAYLOAD"
 
       - name: Add failure comment to target PR
-        if: steps.sync_script.outputs.sync_success == 'false'
+        if: always() && steps.sync_script.outputs.sync_success == 'false'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SOURCE_PR_URL: ${{ github.event.inputs.source_pr_url }}
@@ -175,11 +191,34 @@ jobs:
           TARGET_REPO: ${{ steps.extract_info.outputs.target_repo }}
           TARGET_PR: ${{ steps.extract_info.outputs.target_pr }}
         run: |
-          BODY=$(printf '%s\n\n%s\n%s\n%s\n\n%s' "**Auto-sync failed**" \
-            "**Source PR**: ${SOURCE_PR_URL}" "**Target PR**: ${TARGET_PR_URL}" \
+          BODY=$(printf '%s\n\n%s\n%s\n\n%s' \
+            "**Auto-sync failed**" \
+            "**Source PR**: ${SOURCE_PR_URL}" \
+            "**Target PR**: ${TARGET_PR_URL}" \
             "The sync process encountered an error. Please check the workflow logs for details.")
           PAYLOAD=$(jq -n --arg body "$BODY" '{body: $body}')
           curl -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
             -H "Accept: application/vnd.github.v3+json" \
             "https://api.github.com/repos/${TARGET_OWNER}/${TARGET_REPO}/issues/${TARGET_PR}/comments" \
             -d "$PAYLOAD"
+
+      - name: Add failure comment on early step failure
+        if: failure() && steps.extract_info.outputs.target_owner != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SOURCE_PR_URL: ${{ github.event.inputs.source_pr_url }}
+          TARGET_PR_URL: ${{ github.event.inputs.target_pr_url }}
+          TARGET_OWNER: ${{ steps.extract_info.outputs.target_owner }}
+          TARGET_REPO: ${{ steps.extract_info.outputs.target_repo }}
+          TARGET_PR: ${{ steps.extract_info.outputs.target_pr }}
+        run: |
+          BODY=$(printf '%s\n\n%s\n%s\n\n%s' \
+            "**Auto-sync failed (early step failure)**" \
+            "**Source PR**: ${SOURCE_PR_URL}" \
+            "**Target PR**: ${TARGET_PR_URL}" \
+            "A step before the sync script failed. Please check the workflow logs for details.")
+          PAYLOAD=$(jq -n --arg body "$BODY" '{body: $body}')
+          curl -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            "https://api.github.com/repos/${TARGET_OWNER}/${TARGET_REPO}/issues/${TARGET_PR}/comments" \
+            -d "$PAYLOAD"