Upstream integration action (#18)

* upstream_integration workflow

Signed-off-by: garyschulte <garyschulte@gmail.com>

Author: garyschulte

.github/last_upstream_sha

@@ -0,0 +1 @@
+442e8f366950dea8624ea757b91fbacec11d604c

.github/mock_secrets

@@ -0,0 +1,3 @@
+APP_ID=123456
+APP_PRIVATE_KEY=FAKE_KEY
+MOCK_GITHUB_TOKEN=ghp_mock1234567890abcdef

.github/workflows/upstream_integration.yml

@@ -0,0 +1,113 @@
+name: Cherry-pick new commits from upstream
+
+on:
+  schedule:
+    - cron: '0 2 * * *'  # Nightly
+  workflow_dispatch:
+
+jobs:
+  cherry-pick:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout your repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+
+    - name: Set up Git credentials
+      run: |
+        git config --global user.name "github-actions[bot]"
+        git config --global user.email "github-actions[bot]@users.noreply.github.com"
+        git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
+
+    - name: Generate GitHub App token (real GitHub only)
+      if: ${{ env.ACT != 'true' }}
+      id: app-token
+      uses: tibdex/github-app-token@v1
+      with:
+        app_id: ${{ secrets.UPSTREAM_INTEGRATION_APP_ID }}
+        private_key: ${{ secrets.UPSTREAM_INTEGRATION_APP_PRIVATE_KEY }}
+
+    - name: Add upstream remote and fetch
+      run: |
+        git remote add upstream https://github.com/hyperledger/besu.git
+        git fetch upstream
+
+    - name: Checkout or create upstream_integration branch
+      run: |
+        BRANCH="upstream_integration"
+
+        if git show-ref --quiet refs/heads/$BRANCH; then
+          git checkout $BRANCH
+        elif git ls-remote --exit-code --heads origin $BRANCH; then
+          git fetch origin $BRANCH
+          git checkout -b $BRANCH origin/$BRANCH
+        else
+          git checkout --orphan $BRANCH
+          git reset --hard
+        fi
+
+    - name: Read last cherry-picked SHA
+      id: lastsha
+      run: |
+        SHA_FILE=".github/last_upstream_sha"
+        INITIAL_SHA="442e8f366950dea8624ea757b91fbacec11d604c"
+
+        if [ -f "$SHA_FILE" ]; then
+          LAST_SHA=$(cat "$SHA_FILE" | tr -d '\n')
+
+          if [ -z "$LAST_SHA" ]; then
+            echo "⚠️ SHA file is empty; falling back to default."
+            LAST_SHA="$INITIAL_SHA"
+          elif ! [[ "$LAST_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "⚠️ SHA file contains invalid value: $LAST_SHA; using default."
+            LAST_SHA="$INITIAL_SHA"
+          fi
+        else
+          echo "ℹ️ SHA file not found; using default."
+          LAST_SHA="$INITIAL_SHA"
+        fi
+
+        echo "Using last upstream SHA: $LAST_SHA"
+        echo "last_sha=$LAST_SHA" >> $GITHUB_OUTPUT
+
+    - name: Find commits to cherry-pick
+      id: commits
+      run: |
+        # Get upstream commits since last SHA (still needed)
+        CANDIDATES=$(git rev-list --reverse --no-merges upstream/main ^${{ steps.lastsha.outputs.last_sha }})
+
+        # Build a set of cherry-picked SHAs already present in integration branch
+        PICKED=$(git log upstream_integration --grep='^cherry picked from commit ' --format='%b' \
+          | grep -oE '[0-9a-f]{40}' | sort -u)
+
+        # Filter out duplicates
+        TO_PICK=""
+        for sha in $CANDIDATES; do
+        if [ -n "$PICKED" ] && echo "$PICKED" | grep -q "^$sha$"; then
+            echo "🔁 Skipping already cherry-picked commit: $sha"
+          else
+            TO_PICK="$TO_PICK $sha"
+          fi
+        done
+
+        echo "commits=$TO_PICK" >> $GITHUB_OUTPUT
+
+    - name: Cherry-pick new commits
+      if: ${{ steps.commits.outputs.commits && steps.commits.outputs.commits != '' }}
+      run: |
+        for sha in ${{ steps.commits.outputs.commits }}; do
+          echo "Cherry-picking $sha"
+          git cherry-pick -x $sha || exit 1
+        done
+
+    - name: Update last cherry-picked SHA
+      if: steps.commits.outputs.commits != ''
+      run: |
+        echo "${{ steps.commits.outputs.commits }}" | tr ' ' '\n' | tail -n 1 > .github/last_upstream_sha
+        git add .github/last_upstream_sha
+        git commit -m "Update last_upstream_sha"
+        git push origin upstream_integration
+