CI: Automated trunk upgrade

.github/workflows/trunk-upgrade.yaml

@@ -0,0 +1,62 @@
+name: Automated trunk upgrade
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .trunk/**
+  schedule:
+    - cron: 38 4 * * *
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  trunk-upgrade:
+    name: trunk upgrade
+
+    runs-on: ubuntu-24.04
+    environment: automated
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Trunk
+        run: curl https://get.trunk.io -fsSL | bash -s -- -y
+
+      - name: Trunk upgrade
+        run: trunk upgrade --yes-to-all --ci --color
+
+      - name: Check for changes
+        run: |
+          if git diff --exit-code; then
+            echo "changes=false" >> $GITHUB_ENV
+          else
+            echo "changes=true" >> $GITHUB_ENV
+          fi
+
+      - name: Commit and push to branch
+        if: env.changes == 'true'
+        uses: EndBug/add-and-commit@v9
+        with:
+          github_token: ${{ secrets.GH_TOKEN }}
+          default_author: github_actions
+          message: Automated trunk upgrade
+          new_branch: automated/trunk-upgrade
+          push: origin automated/trunk-upgrade --set-upstream --force
+
+      - name: Create pull request
+        if: env.changes == 'true'
+        uses: devops-infra/action-pull-request@master
+        with:
+          github_token: ${{ secrets.GH_TOKEN }}
+          target_branch: main
+          label: automated
+          title: Automated trunk upgrade
+          get_diff: true