Add GitHub Actions workflow to auto-sync API from calico-private (#183)

Same approach as the projectcalico/api sync workflow
(projectcalico/api#120), but pulls from
`tigera/calico-private` instead. Uses `MARVIN_PAT` for private repo
access (same pattern as the operator `sync-versions` workflow).

Auto-discovers `master` + the two most recent `release-calient-*`
branches, so it doesn't need updating when new release branches are
created. Runs hourly + manual dispatch.

Author: caseydavenport

.github/workflows/sync-calico-api.yml

@@ -0,0 +1,75 @@
+# Sync API files from tigera/calico-private into this repo.
+# Creates or updates a PR if anything changed.
+---
+name: Sync Calico API
+on:  # yamllint disable-line rule:truthy
+  schedule:
+    - cron: '0 * * * *'  # every hour
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  discover-branches:
+    if: github.repository == 'tigera/api'
+    runs-on: ubuntu-latest
+    outputs:
+      branches: ${{ steps.branches.outputs.branches }}
+    steps:
+      - name: Discover branches
+        id: branches
+        run: |
+          # Get master + the two most recent release branches (by semver).
+          branches=$(gh api repos/${{ github.repository }}/branches --paginate --jq '
+            [.[] | select(.name | test("^release-calient-v[0-9]+\\.[0-9]+$")) | .name]
+            | sort_by(ltrimstr("release-calient-v") | split(".") | map(tonumber))
+            | .[-2:]
+            | ["master"] + .
+          ')
+          echo "branches=${branches}" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  sync:
+    needs: discover-branches
+    runs-on: ubuntu-latest
+    concurrency:
+      group: sync-calico-api-${{ matrix.branch }}
+      cancel-in-progress: true
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJson(needs.discover-branches.outputs.branches) }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          ref: ${{ matrix.branch }}
+          persist-credentials: false
+
+      - name: Configure git auth
+        run: |
+          git config --global credential.helper store
+          echo "https://marvin-tigera:${GITHUB_TOKEN}@github.com" > ~/.git-credentials
+          git config --global url."https://github.com/".insteadOf "git@github.com:"
+        env:
+          GITHUB_TOKEN: ${{ secrets.MARVIN_PAT }}
+
+      - name: Sync API from calico-private
+        run: make -f Makefile.local update
+
+      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "Automatic API update from tigera/calico-private ${{ matrix.branch }}"
+          branch: auto-api-update-${{ matrix.branch }}
+          base: ${{ matrix.branch }}
+          title: "Auto: sync API from tigera/calico-private [${{ matrix.branch }}]"
+          body: |
+            Automated sync of API files from `tigera/calico-private` `${{ matrix.branch }}`
+            branch into this repo via `make -f Makefile.local update`.
+
+            Triggered by scheduled workflow.
+          labels: docs-not-required,release-note-not-required,merge-when-ready,delete-branch
+          delete-branch: true