Automatically assign milestones to dependency upgrade PRs (#2120)

This new GitHub Actions workflow assigns the first upcoming open
milestone to pull requests labeled `dependencies`, if no milestone is 
already assigned.

Author: rickie

.github/workflows/assign-milestone.yml

@@ -0,0 +1,61 @@
+name: Assign milestone to dependency upgrade PR
+on:
+  pull_request_target:
+    types:
+      - labeled
+permissions:
+  contents: read
+jobs:
+  assign-milestone:
+    if: ${{ github.event.label.name == 'dependencies' && github.event.pull_request.milestone == null }}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Install Harden-Runner
+        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        with:
+          disable-sudo-and-containers: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+      - name: Assign first upcoming milestone
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const milestones = (await github.rest.issues.listMilestones({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              per_page: 100,
+            })).data;
+
+            if (milestones.length === 0) {
+              core.warning('No open milestones found.');
+              return;
+            }
+
+            const parseVersion = (title) => title.split('.').map(Number);
+            const compareVersions = (a, b) => {
+              const va = parseVersion(a);
+              const vb = parseVersion(b);
+              for (let i = 0; i < Math.max(va.length, vb.length); i++) {
+                const diff = (va[i] ?? 0) - (vb[i] ?? 0);
+                if (diff !== 0) {
+                  return diff;
+                }
+              }
+              return 0;
+            };
+            const milestone = milestones.reduce((a, b) => compareVersions(a.title, b.title) <= 0 ? a : b);
+            core.info(`Assigning milestone "${milestone.title}" to PR #${context.issue.number}.`);
+
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              milestone: milestone.number,
+            });