ci: one-shot refresh integrity after Quick trigger

Author: niakw

.github/workflows/tmp-refresh-integrity.yml

@@ -0,0 +1,39 @@
+name: One-shot refresh release integrity
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/tmp-refresh-integrity.yml'
+
+permissions:
+  contents: write
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          fetch-depth: 0
+      - name: Regenerate and validate exact release hashes
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 scripts/generate_release_hashes.py
+          python3 scripts/validate_release_integrity.py
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add FILE-HASHES.json PATCH-SHA256SUMS.txt SHA256SUMS.json
+          if ! git diff --cached --quiet; then
+            git commit -m 'chore: refresh release integrity after Quick trigger [skip ci]'
+            git fetch origin main
+            git rebase origin/main
+            python3 scripts/generate_release_hashes.py
+            python3 scripts/validate_release_integrity.py
+            git add FILE-HASHES.json PATCH-SHA256SUMS.txt SHA256SUMS.json
+            if ! git diff --cached --quiet; then git commit --amend --no-edit; fi
+            git push origin HEAD:main
+          fi