ci: merge main and release branches forward

- Replaces sync-main-to-next, which merged main into next every 10 minutes

.gitattributes

@@ -5,6 +5,7 @@
 *.html diff=html
 *.md diff=markdown
 *.php diff=php
+CHANGELOG.md merge=union
 
 /.github export-ignore
 CHANGELOG.md export-ignore

.github/workflows/merge-forward.yaml

@@ -0,0 +1,92 @@
+name: Merge forward
+
+on:
+  schedule:
+    - cron: "40 8,19 * * *"
+  workflow_dispatch:
+  workflow_call:
+
+permissions: {}
+
+cache-mode: none
+
+concurrency:
+  group: merge-forward
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  merge:
+    name: Merge forward
+    permissions:
+      contents: write # push the merges
+      pull-requests: write # open a pull request when a merge conflicts
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # https://github.com/actions/checkout/releases/tag/v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Merge main into the release branches and next, the release branches into next
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BODY: |
+            The branches do not merge without conflicts. Resolve them on this branch, with the Resolve conflicts button of this pull request or with a merge of the base branch on a checkout of it. Both leave the source branch as it is.
+
+            Then merge this pull request with a merge commit. A squash merge leaves the source branch unmerged, so the next merge conflicts again.
+        run: |
+          gh auth setup-git
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          push() {
+            if [ "$(git rev-parse HEAD)" != "$(git rev-parse "origin/$1")" ]; then
+              awk 'NR > 1 && /^#/ && previous != "" { print "" } { print; previous = $0 }' CHANGELOG.md > "$RUNNER_TEMP/CHANGELOG.md"
+              cp "$RUNNER_TEMP/CHANGELOG.md" CHANGELOG.md
+              git diff --quiet || git commit --quiet --amend --no-edit --all
+            fi
+            git push --quiet origin "HEAD:$2"
+          }
+          merge() {
+            local head="chore/merge-${1//\//-}-into-${2//\//-}" tag title conflicts pull_request
+            git switch --quiet --detach "origin/$2"
+            if git merge-base --is-ancestor "origin/$1" HEAD; then
+              echo "$2 contains $1 already"
+              return
+            fi
+            tag="$(git tag --points-at "origin/$1" | sed -n 1p)"
+            title="chore: merge ${tag:-$1} into $2"
+            if git merge --quiet --no-edit --message "$title" "origin/$1"; then
+              push "$1" "$2"
+              return
+            fi
+            conflicts="$(git diff --name-only --diff-filter=U)"
+            git merge --abort
+            if [ "$conflicts" = release.json ] && git merge --quiet --no-edit --strategy-option ours --message "$title" "origin/$1"; then
+              push "$1" "$2"
+              return
+            fi
+            if git rev-parse --verify --quiet "origin/$head" > /dev/null && ! git merge-base --is-ancestor "origin/$head" "origin/$1"; then
+              echo "::notice::$head has commits of its own, $1 follows once its pull request is merged"
+              return
+            fi
+            git push --quiet origin "origin/$1:refs/heads/$head"
+            pull_request="$(gh pr list --head "$head" --base "$2" --json url --jq '.[0].url')"
+            if [ -n "$pull_request" ]; then
+              gh pr edit "$pull_request" --title "$title"
+            else
+              gh pr create --base "$2" --head "$head" --title "$title" --body "$BODY"
+            fi
+          }
+          releases="$(git branch --remotes --list 'origin/release/*' --format='%(refname:lstrip=3)' | grep -vE '\.0$' | sort -V || true)"
+          for release in $releases; do
+            merge main "$release"
+          done
+          for release in $releases; do
+            merge "$release" next
+          done
+          merge main next

.github/workflows/sync-main-to-next.yml

@@ -1,65 +0,0 @@
-name: Sync main to next
-
-on:
-  schedule:
-    - cron: '*/10 * * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: sync-main-to-next
-  cancel-in-progress: false
-
-jobs:
-  sync:
-    name: Merge main into next
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Merge main into next
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          git config user.name 'github-actions[bot]'
-          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git fetch origin main next
-          git checkout --quiet -B next origin/next
-
-          if git merge --no-edit origin/main; then
-            git push origin HEAD:refs/heads/next
-            exit 0
-          fi
-
-          conflicts=$(git diff --name-only --diff-filter=U)
-          git merge --abort
-
-          if [ -z "$conflicts" ]; then
-            echo '::error title=main to next sync failed::The merge failed without conflicts, so no pull request was created.'
-            exit 1
-          fi
-
-          sync_branch='automation/sync-main-to-next'
-          existing_pr=$(gh pr list --base next --head "$sync_branch" --state open --json url --jq '.[0].url')
-          if [ -n "$existing_pr" ]; then
-            # The conflict was already reported when this pull request was opened.
-            # Stay green until it is merged instead of failing every scheduled run.
-            echo "::notice title=main to next sync blocked::main still conflicts with next; resolve the open pull request: $existing_pr"
-            exit 0
-          fi
-
-          git push --force origin origin/main:"refs/heads/$sync_branch"
-          gh pr create \
-            --base next \
-            --head "$sync_branch" \
-            --title 'chore: merge main into next' \
-            --body 'This pull request was created automatically because main could not be merged into next without conflicts. Resolve conflicts on this temporary branch; never update main with next.'
-
-          echo '::error title=main to next sync blocked::main could not be merged into next without conflicts; a pull request was opened to resolve them.'
-          exit 1