ci: update in-repo PR branches after main changes - #376

Summary

• add a GitHub Actions workflow that runs after pushes to main and can also be dispatched manually
• enumerate open PRs targeting main and queue GitHub's update-branch API only for head branches hosted in NVIDIA/SkillSpector
• explicitly skip fork-hosted head branches with a workflow notice
• serialize update runs, use least-privilege write permissions, and report queued/skipped/failed counts
• keep the DCO check compatible by exempting only GitHub-generated merge commits while continuing to require sign-off on contributor commits

Purpose

This is a maintenance workflow for PR branches created directly in the NVIDIA/SkillSpector repository. When main changes, it asks GitHub to merge the updated base into each eligible in-repository PR branch.

Explicit non-goals

This workflow:

• does not approve or start CI for fork-based PRs
• does not update or rebase contributor fork branches
• does not change the repository's fork-PR workflow approval policy
• does not introduce a personal access token or repository secret

At implementation time, 2 of 39 open PRs used repository-hosted branches; the other 37 used forks and would be skipped. This PR therefore does not address the manual CI-approval burden for contributor-fork PRs.

DCO compatibility

GitHub's update-branch API creates merge commits without a DCO trailer. The accompanying CI change narrowly exempts GitHub-generated merge commits whose contributor commits were already checked; all contributor commits continue to require sign-off.

Validation

• parsed both changed workflow files as YAML
• syntax-checked both embedded Bash scripts
• ran git diff --check
• exercised the PR enumeration query read-only against all 39 current open PRs
• verified DCO classification for a GitHub-generated merge, an unsigned contributor merge, and a signed contributor commit