Seed workflow files for Copybara automation

GitOrigin-RevId: 5a4ac9901379c67689acd455052289b01a7e164a
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: DavidS-ovm

.github/workflows/finalize-copybara-sync.yml

@@ -0,0 +1,84 @@
+name: Finalize Copybara Sync
+
+on:
+  push:
+    branches:
+      - 'copybara/v*'
+
+concurrency:
+  group: copybara-sync-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  finalize:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Extract version from branch name
+        id: version
+        run: |
+          VERSION=$(echo "$GITHUB_REF" | sed 's|refs/heads/copybara/||')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Extract original commit author
+        id: author
+        run: |
+          AUTHOR_EMAIL=$(git log -1 --format='%ae' --author='^(?!.*actions@github.com)' --perl-regexp 2>/dev/null || git log -1 --format='%ae')
+          AUTHOR_NAME=$(git log -1 --format='%an' --author='^(?!.*actions@github.com)' --perl-regexp 2>/dev/null || git log -1 --format='%an')
+          echo "email=$AUTHOR_EMAIL" >> $GITHUB_OUTPUT
+          echo "name=$AUTHOR_NAME" >> $GITHUB_OUTPUT
+
+          if [[ "$AUTHOR_EMAIL" =~ ^([^@]+)@users\.noreply\.github\.com$ ]]; then
+            GITHUB_USER=$(echo "${BASH_REMATCH[1]}" | sed 's/^[0-9]*+//')
+            echo "github_user=$GITHUB_USER" >> $GITHUB_OUTPUT
+          else
+            echo "github_user=" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create Pull Request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+          AUTHOR_NAME: ${{ steps.author.outputs.name }}
+          AUTHOR_EMAIL: ${{ steps.author.outputs.email }}
+          GITHUB_USER: ${{ steps.author.outputs.github_user }}
+        run: |
+          PR_BODY="## Copybara Sync - Release ${VERSION}
+
+          This PR was automatically created by Copybara, syncing changes from the [overmindtech/workspace](https://github.com/overmindtech/workspace) monorepo.
+
+          **Original author:** ${AUTHOR_NAME} (${AUTHOR_EMAIL})
+
+          ### What happens when this PR is merged?
+
+          1. The \`tag-on-merge\` workflow will automatically create the \`${VERSION}\` tag on main
+          2. Terraform Registry will detect the tag via webhook and publish the module
+
+          ### Review Checklist
+
+          - [ ] Changes look correct and match the expected monorepo sync
+          "
+
+          PR_URL=$(gh pr create \
+            --base main \
+            --head "${{ github.ref_name }}" \
+            --title "Release ${VERSION}" \
+            --body "$PR_BODY")
+
+          echo "Created PR: $PR_URL"
+
+          if [ -n "$GITHUB_USER" ]; then
+            echo "Requesting review from original author: $GITHUB_USER"
+            gh pr edit "$PR_URL" --add-reviewer "$GITHUB_USER" || true
+          fi
+
+          echo "Requesting review from Engineering team"
+          gh pr edit "$PR_URL" --add-reviewer "overmindtech/Engineering" || true

.github/workflows/tag-on-merge.yml

@@ -0,0 +1,52 @@
+name: Tag Release on Merge
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+jobs:
+  tag-release:
+    if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'copybara/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Extract version from branch name
+        id: version
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          VERSION=$(echo "$BRANCH" | sed 's|copybara/||')
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Extracted version: $VERSION"
+
+      - uses: actions/checkout@v6
+        with:
+          ref: main
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_PAT }}
+
+      - name: Configure Git
+        run: |
+          git config user.name "GitHub Actions Bot"
+          git config user.email "actions@github.com"
+
+      - name: Create and push tag
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          echo "Creating tag: $VERSION"
+          git tag "$VERSION"
+          git push origin "$VERSION"
+          echo "Successfully pushed tag $VERSION"
+
+      - name: Delete copybara branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          echo "Deleting branch: $BRANCH"
+          git push origin --delete "$BRANCH" || echo "Branch may have already been deleted"