Add automated upstream update workflow

update-version.sh bumps the pinned Patchwork release: it fetches the latest
upstream tag, downloads both tar.gz assets, updates versions.sh, the manifest
and the metainfo, then self-validates with check-versions.sh. A daily cron
workflow commits the bump and opens a PR labeled automerge; the CI workflow
builds the Flatpak in the freedesktop-24.08 container and auto-merges the PR
once the checks pass.

.github/workflows/build.yml

@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Validate scripts and pinned versions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Shell syntax check
+        run: bash -n build.sh check-versions.sh update-version.sh versions.sh
+      - name: Validate pinned versions
+        run: ./check-versions.sh
+
+  build:
+    name: Build Flatpak
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-24.08
+      options: --privileged
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Electron base app
+        run: |
+          flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+          flatpak install -y flathub org.electronjs.Electron2.BaseApp//24.08
+      - uses: flatpak/flatpak-github-actions/flatpak-builder@v6
+        with:
+          bundle: patchwork.flatpak
+          manifest-path: nz.scuttlebutt.Patchwork.yaml
+          verbose: true
+
+  merge:
+    name: Auto-merge update PR
+    runs-on: ubuntu-latest
+    needs: [check, build]
+    if: |
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.state == 'open' &&
+      github.event.pull_request.user.login == 'github-actions[bot]' &&
+      contains(github.event.pull_request.labels.*.name, 'automerge') &&
+      (github.event.pull_request.mergeable_state == 'clean' ||
+       github.event.pull_request.mergeable_state == 'behind')
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Update branch if behind
+        if: github.event.pull_request.mergeable_state == 'behind'
+        run: gh pr update-branch "${{ github.event.pull_request.number }}"
+      - name: Merge
+        run: gh pr merge --squash --delete-branch "${{ github.event.pull_request.number }}"