Add workflow to handle wait-merge label task

[techknowlogick]

Currently, we are using the backport-bot for this, however to decrease our external infra requirements we can bring that functionality into a workflow.

The jobs are:

1. call update-branch api endpoint on any PR that is open and has the reviewed/wait-merge label
2. remove the reviewed/wait-merge label from any PR that is closed/merged

Once this is merged, I'll be able to add the giteabot apptoken to the repo secrets, and send a PR to the backport bot to remove the update-branch logic from it.

Note: this has to use app tokens instead of built-in workflow permissions because they are limited to the repo itself and can't call update branch for PRs that are in forks.

[Copilot]

Pull request overview

This PR adds a new GitHub Actions workflow to automate handling of PRs with the reviewed/wait-merge label, replacing functionality previously provided by an external backport-bot. The workflow updates branches for open PRs and cleans up labels from closed/merged PRs.

Changes:

• Added a new workflow file .github/workflows/sync-prs.yml that triggers on push to main and manual dispatch
• Implements two jobs: one to update branches of PRs with the reviewed/wait-merge label, and another to remove the label from closed PRs

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The cleanup-labels job should include error handling similar to the update-prs job. Currently, if removing a label fails, the error is only logged but doesn't affect the exit code. Consider tracking failures and exiting with a non-zero code if any labels fail to be removed, similar to how the update-prs job handles failures.

Suggested change

	for pr_number in $closed_prs; do
	if gh pr edit "$pr_number" --repo ${{ github.repository }} --remove-label "reviewed/wait-merge"; then
	echo "#$pr_number label removed"
	else
	echo "#$pr_number failed to remove label"
	fi
	done
	failed=0
	for pr_number in $closed_prs; do
	if gh pr edit "$pr_number" --repo ${{ github.repository }} --remove-label "reviewed/wait-merge"; then
	echo "#$pr_number label removed"
	else
	echo "#$pr_number failed to remove label"
	failed=1
	fi
	done
	if [ "$failed" -ne 0 ]; then
	echo ""
	echo "One or more labels failed to be removed from closed PRs."
	fi
	exit $failed

[Copilot]

The cleanup-labels job does not verify authentication status before attempting to remove labels, unlike the update-prs job which checks 'gh auth status' on line 20. For consistency and to catch authentication issues early, consider adding the same authentication check at the beginning of this job's script.

Suggested change

	run: |
	run: |
	gh auth status || exit 1

[Copilot]

The workflow name 'task-wait-merge-label' is inconsistent with the file name 'sync-prs.yml'. Based on other workflows in this repository (e.g., 'cron-licenses' in cron-licenses.yml, 'labeler' in pull-labeler.yml), the name should match the file name more closely. Consider renaming the workflow to 'sync-prs' to match the file name, or rename the file to 'task-wait-merge-label.yml' to match the workflow name.

Suggested change

	name: task-wait-merge-label
	name: sync-prs

[Copilot]

This workflow triggers on every push to main, which could result in frequent executions when there are multiple commits pushed to main in quick succession. Other workflows in this repository that perform scheduled maintenance tasks (like cron-licenses.yml and cron-translations.yml) use a schedule trigger with workflow_dispatch as a fallback. Consider using a schedule trigger instead (e.g., running every few hours or daily) to reduce unnecessary workflow executions, while keeping workflow_dispatch for manual runs.

[Copilot]

Similar to the release-nightly.yml workflow which also triggers on push to main, this workflow should include a concurrency configuration to prevent multiple instances from running simultaneously. This is especially important to avoid race conditions when updating PRs or removing labels. Add a concurrency section with group and cancel-in-progress settings.

Suggested change

	concurrency:
	group: task-wait-merge-label-${{ github.ref }}
	cancel-in-progress: true

[lunny]

I don't think we need that. We just need to enable merge queue feature.

[yardenshoham]

Both approve and agree with @lunny

[wxiaoguang]

the unmaintainable and untestable inline scripts should be avoided.