add sync-upstream action

[brooksn]

This PR adds a reusable action to sync a forked repo with any number of upstream branches

• maintains upstream history
• adds checks to branches

Intended workflow:

graph TB
    %% Upstream
    subgraph "Upstream"
        UP_Main["Main Branch"]
        UP_Release["Release Branch (1.2)"]
    end

    %% Fork
    subgraph "Fork"
        FORK_Main["Main Branch"]
        FORK_Release["Release Branch (1.2)"]
        FORK_CVE["CVE Patch Branch (release-1.2-cve1)"]
    end

    %% Sync Workflow (runs in main branch)
    subgraph "Sync Workflow"
        Sync_Action["GitHub Action: Sync Upstream Release"]
    end

    %% Security Patch Process
    subgraph "Security Patch Process"
        Step_Create["1. Create CVE Branch"]
        Step_PR["2. Open Pull Request"]
        Step_Merge["3. Squash & Merge"]
        Step_Tag["4. Tag Release"]
    end

    %% Sync Workflow Connections
    FORK_Main --> Sync_Action
    UP_Release -->|Sync| Sync_Action
    Sync_Action --> FORK_Release

    %% Security Patch Process Connections
    FORK_Release -->|Branch off to create| FORK_CVE
    Step_Create --> FORK_CVE
    FORK_CVE --> Step_PR
    Step_PR --> Step_Merge
    Step_Merge --> Step_Tag

Loading

[nicholasSUSE]

Congratulations on the Mermaid Flowgram!

[nicholasSUSE]

The secrets of GITHUB_TOKEN are being deprecated, we have to use from the vault.

[nicholasSUSE]

      GH_TOKEN: ${{ steps.app-token.outputs.token }}

[nicholasSUSE]

  - name: Load Secrets from Vault
    continue-on-error: false
    uses: rancher-eio/read-vault-secrets@main
    with:
      secrets: |
        secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APP_ID ;
        secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATE_KEY ;

  - name: Create App Token
    continue-on-error: false
    uses: actions/create-github-app-token@v1
    id: app-token
    with:
      app-id: ${{ env.APP_ID }}
      private-key: ${{ env.PRIVATE_KEY }}