Add automated CommonCore backport workflow

- Create backport PRs for merged CommonCore changes on `main`
- Auto-merge successful backport PRs into `version/*` branches
- Add opt-out label handling for backports

.gitea/workflows/pull-request-build.yml

@@ -3,6 +3,10 @@ name: Pull Request Build
 on:
   pull_request:
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   build:
     name: Build
@@ -39,3 +43,34 @@ jobs:
           echo "$SW_MAVEN_CREDENTIALS" > steamwar.properties
       - name: Build with Gradle
         run: ./gradlew build --no-daemon
+
+      - name: Merge successful backport PR
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BACKPORT_BRANCH_PREFIX: backport/commoncore
+        run: |
+          set -euo pipefail
+
+          head_branch="$(jq -r '.pull_request.head.ref // ""' "$GITHUB_EVENT_PATH")"
+          base_branch="$(jq -r '.pull_request.base.ref // ""' "$GITHUB_EVENT_PATH")"
+          pr_number="$(jq -r '.pull_request.number' "$GITHUB_EVENT_PATH")"
+
+          if [[ "${head_branch}" != "${BACKPORT_BRANCH_PREFIX}/"* ]]; then
+            echo "Not a CommonCore backport PR."
+            exit 0
+          fi
+
+          if [[ "${base_branch}" != version/* ]]; then
+            echo "Backport PR target is not a version/* branch."
+            exit 0
+          fi
+
+          api_url="${GITHUB_API_URL:-${GITHUB_SERVER_URL}/api/v1}"
+
+          curl -fsS -X PUT \
+            -H "Accept: application/json" \
+            -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do":"merge","delete_branch_after_merge":true}' \
+            "${api_url}/repos/${GITHUB_REPOSITORY}/pulls/${pr_number}/merge"