feat: add upstream sysroot_scripts monitoring (#45)

* feat: add upstream sysroot_script monitoring

* chore: feedback from review

* Add upgrades ping

Author: codebytere

.github/workflows/upstream-sysroot.yml

@@ -0,0 +1,84 @@
+name: Check Upstream Sysroot Updates
+
+description: |
+  This workflow runs every two weeks, checks our sysroot scripts against Chromium's
+  at build/linux/sysroot_scripts and opens an issue if there are any new changes.
+
+on:
+  schedule:
+    - cron: "0 0 1,15 * *"
+  workflow_dispatch:
+    inputs:
+      current-sha:
+        type: string
+        description: 'Current SHA for build/linux/sysroot_scripts'
+        required: false
+      upstream-sha:
+        type: string
+        description: 'Upstream SHA for build/linux/sysroot_scripts'
+        required: false
+
+jobs:
+  check-upstream-sysroot:
+    permissions:
+      issues: write
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - name: Fetch Current SHA
+      shell: bash
+      run: |
+        if [ -n "${{ github.event.inputs.current-sha }}" ]; then
+          CURRENT_SHA="${{ github.event.inputs.current-sha }}"
+        elif [ -f current-sha.json ]; then
+          CURRENT_SHA=$(jq -r '.sha' current-sha.json)
+        else
+          echo "No current SHA provided and current-sha.json not found."
+          exit 1
+        fi
+        echo "CURRENT_SHA=${CURRENT_SHA}" >> $GITHUB_ENV
+    - name: Fetch latest upstream SHA
+      shell: bash
+      run: |
+        if [ -n "${{ github.event.inputs.upstream-sha }}" ]; then
+          UPSTREAM_SHA="${{ github.event.inputs.upstream-sha }}"
+        else
+          UPSTREAM_SHA=$(gh api -X GET repos/chromium/chromium/commits -f path="build/linux/sysroot_scripts" -f per_page=1 --jq '.[0].sha')
+        fi
+        echo "UPSTREAM_SHA=${UPSTREAM_SHA}" >> $GITHUB_ENV
+    - name: Compare current SHA with upstream SHA
+      shell: bash
+      run: |
+        if [ "${{ env.CURRENT_SHA }}" == "${{ env.UPSTREAM_SHA }}" ]; then
+          echo "No changes found - sysroot scripts are up to date!"
+        else
+          gh api -X GET repos/chromium/chromium/commits -f path="build/linux/sysroot_scripts" -f per_page=20 > commits.json
+
+          COMMITS=$(
+            jq -r --arg base_sha "${{ env.CURRENT_SHA }}" '
+              ([.[].sha] | index($base_sha) // length) as $idx |
+              .[0:$idx] | .[] | 
+              "- [`\(.sha[0:7])`](\(.html_url)) \(.commit.message | split("\n")[0])"
+            ' commits.json
+          )
+
+          if [ -z "$COMMITS" ]; then
+            echo "No new commits found."
+            exit 0
+          fi
+
+          ISSUE_BODY=$(cat <<EOF
+        ### Upstream sysroot scripts have been updated
+
+        Commits between \`${CURRENT_SHA:0:7}\` and \`${UPSTREAM_SHA:0:7}\`:
+
+        ${COMMITS}
+
+        @electron/wg-upgrades please review these changes and update our scripts accordingly.
+        EOF
+          )
+
+          gh issue create --title "Upstream sysroot scripts have changed" --body="$ISSUE_BODY"
+        fi

current-sha.json

@@ -0,0 +1,3 @@
+{
+  "sha": "082a46c99411023b97fae0476b526b54ff98aa3d" 
+}