Auto-sync edge branch from upstream

[patcon]

Re-ticketed from #50 (comment)

We've now protected the edge branch so that it's read-only, and can only be updated by clicking the "sync fork" button from upstream. We can make this happen automatically, so it's always up-to-date with them:

https://github.com/marketplace/actions/fork-sync

[patcon]

Or maybe using these, because we don't need PRs, and I think PRs would rewrite commit history, rather than just push with fast-forward merge style.

• https://github.com/actions/checkout (checkout upstream)
• manually git remote set-url origin <our remote>
• https://github.com/marketplace/actions/merge-fast-forward-only

EDIT: On third thought, I think this is the approach:

• https://github.com/actions/checkout (checkout upstream)
• manually git remote set-url origin <our remote>
• https://github.com/ad-m/github-push-action

[patcon]

Ah, realized an alternative approach that isn't so confusing for others (besides me) to debug/maintain:

• instead of the Set up auto-syncing of edge branch from upstream (with branch locked for everything else) #55 solution that does a fancy "git push" dance with upstream, it uses new github action that uses the specific "Fork Sync" endpoint in the GitHub API, which has a special permission that can be set in "classic branch protection".
  • https://github.com/marketplace/actions/merge-upstream-action
• we can go back to "classic branch protection" instead of the new "branch protection rulesets"
  • no need to set up and understand "deploy keys" and manage extra envvars for GitHub Actions
  • just set "lock branch" and "allow fork syncing" on "classic branch protection"
  • BONUS: the "fork sync" in the UI will still work, unlike the other solutions.

I think we should close the other in favour of the above, which is much less "clever", in a good way :)