chore(ci): stop hardcoding stable-branch (#2605)

Instead we can define an environment variable for github actions.

For things where we can't, globs/regex is probably good enough.

When we branch/stabilize "stable-f45" then we will delete the old one
anyway, so we shouldn't be in a situation where we'll get spammed with
like 3 PRs.

The only remaining things where it's hardcoded is the pull config and
docs.

.github/renovate.json5

@@ -4,7 +4,7 @@
     "config:best-practices"
   ],
 
-  "baseBranchPatterns": ["main", "stable-f44"],
+  "baseBranchPatterns": ["main", "/^stable-f[0-9][0-9]$/"],
 
   // Do not rebase when the default branch is updated
   "rebaseWhen": "never",
@@ -59,7 +59,7 @@
       ],
       // Brew and common are not "security updates", they have to go through :testing/main first
       // to reach a stable release
-      "matchBaseBranches": ["stable-f44"],
+      "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
       "enabled": false
     },
     {

.github/workflows/build-image-latest-main.yml

@@ -2,17 +2,17 @@ name: Latest Images
 on:
   push:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"
       - ".github/workflows/scorecard.yml"
   merge_group:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
   pull_request:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"

.github/workflows/build-image-stable.yml

@@ -6,7 +6,7 @@ on:
   # We still want to know if things are broken
   pull_request:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"

.github/workflows/cherry-pick-to-stable.yml

@@ -47,7 +47,7 @@ jobs:
         with:
           # Use the dynamically generated GitHub App token here too
           github_token: ${{ steps.generate-token.outputs.token }}
-          target_branches: "stable-f44"
+          target_branches: ${{ vars.STABLE_BRANCH }}
           add_labels: "backported-to-stable"
           pull_title: '${pull_title} [Backport ${target_branch}]'
           pull_description: |

.github/workflows/generate-release.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 500
-          ref: stable-f44
+          ref: ${{ vars.STABLE_BRANCH }}
 
       - name: Install Just
         run: |

.github/workflows/trigger-schedule-stable-image.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Trigger Stable Image Build
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BRANCH: stable-f44
+          BRANCH: ${{ vars.STABLE_BRANCH }}
         run: |
           gh workflow run \
             build-image-stable.yml \