ci: add workflow that syncs tracking sources

Signed-off-by: You-Sheng Yang <vicamo@gmail.com>

Author: vicamo

.github/workflows/sync-sources.yml

@@ -0,0 +1,104 @@
+---
+name: Sync tracking sources
+
+on:
+  workflow_dispatch:
+    #checkov:skip=CKV_GHA_7:Deliberately keep a try_run option
+    inputs:
+      try_run:
+        description: 'Do not actually push new HEADs'
+        required: true
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  sync-repo:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Enumerate tracking branches
+        run: |
+          mapfile -t branches < <(git branch --remotes --list 'origin/linux*' | cut -d/ -f2,3)
+          echo "TRACKING_SOURCES=${branches[*]}" | tee -a "${GITHUB_ENV}"
+
+      - name: Fetch remotes
+        run: |
+          git remote add noble https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble
+          git remote add oem-noble https://git.launchpad.net/~canonical-kernel/ubuntu/+source/linux-oem/+git/noble
+          git fetch -p --all
+
+      - name: Collect updating refs
+        run: |
+          declare -a refspecs
+
+          # Latest
+          #shellcheck disable=SC2086
+          for source in ${TRACKING_SOURCES}; do
+            series="${source#*/}"
+            package="${source%/*}"
+
+            remote_branch=
+            flavor=
+            case "${package}" in
+              linux)
+                remote_branch="${series}/master-next"
+                flavor=master
+                tag_prefix=Ubuntu
+                ;;
+              linux-hwe-*)
+                remote_branch="${series}/${package#linux-}-next"
+                flavor="${package#linux-}"
+                tag_prefix="Ubuntu-${package#linux-}"
+                ;;
+              linux-oem-*)
+                remote_branch="oem-${series}/${package#linux-}-next"
+                flavor=oem
+                tag_prefix="Ubuntu-${package#linux-}"
+                ;;
+              *)
+                echo "Unsupported source ${source}" >&2; exit 1
+                ;;
+            esac
+
+            mapfile -t versions < <(git show ${remote_branch}:debian.${flavor}/changelog | awk "/^${package} / { print \$2 }" | tr -d '()' | tr '~' '_')
+            latest_tag=
+            for version in "${versions[@]}"; do
+              latest_tag="$(git tag -l | { grep "^${tag_prefix}-${version}\$" || true; })"
+              if [ -n "${latest_tag}" ]; then
+                refspecs+=("${latest_tag}:refs/heads/${source}/latest")
+                break
+              fi
+            done
+
+            case "${package}" in
+              linux)
+                refspecs+=("${series}/master-next:refs/heads/${source}/staging")
+                ;;
+              linux-hwe-*)
+                refspecs+=("${series}/${package#linux-}-next:refs/heads/${source}/staging")
+                ;;
+              linux-oem-*)
+                refspecs+=("oem-${series}/${package#linux-}-next:refs/heads/${source}/staging")
+                ;;
+              *)
+                echo "Unsupported source ${source}" >&2; exit 1
+                ;;
+            esac
+          done
+
+          echo "PUSH_REFSPECS=${refspecs[*]}" | tee -a "${GITHUB_ENV}"
+
+      - name: Push changes
+        if: ${{ !inputs.try_run && contains(env.PUSH_REFSPECS, ':') }}
+        run: |
+          github_server_proto="${GITHUB_SERVER_URL%%//*}"
+          github_server_host="${GITHUB_SERVER_URL#*//}"
+          remote="${github_server_proto}//${{ secrets.REPO_SYNC_TOKEN }}@${github_server_host}/${GITHUB_REPOSITORY}.git"
+
+          #shellcheck disable=SC2086
+          git push --force --atomic "${remote}" ${PUSH_REFSPECS}