Merge upstream daily, then build [skip ci]

A daily schedule (and Run workflow) first merges github.com/ublue-os/aurora
main into ours and pushes the merge, then builds and publishes, picking up
upstream's changes and the day's Fedora package updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -14,9 +14,18 @@ name: Build Aurora
 # Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
 # Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
 
+# Daily (and on "Run workflow"), it first merges upstream's main
+# (github.com/ublue-os/aurora) into ours and pushes the merge, then builds:
+# upstream's changes, plus the day's Fedora package updates, which Aurora's
+# build resolves at build time. quine-global-labs/quine-linux builds on the
+# result two hours later. A push made with the job's own token doesn't start
+# another run, so the merge and the build happen in this one. A conflict
+# fails the run before anything is pushed.
 on:
   push:
     branches: [main]
+  schedule:
+    - cron: '0 5 * * *'
   workflow_dispatch:
 
 concurrency:
@@ -34,6 +43,22 @@ jobs:
     timeout-minutes: 300
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Merge upstream
+        if: github.event_name != 'push'
+        run: |
+          git config user.name "forgejo-actions"
+          git config user.email "actions@forge.quinefoundation.com"
+          git fetch --no-tags https://github.com/ublue-os/aurora.git main
+          before=$(git rev-parse HEAD)
+          git merge --no-edit -m "Merge upstream ublue-os/aurora main" FETCH_HEAD
+          if [ "$(git rev-parse HEAD)" != "$before" ]; then
+            git push origin HEAD:main
+          else
+            echo "Already up to date with upstream."
+          fi
 
       - name: Build
         # Aurora reads its own past tags from ghcr.io/$GITHUB_REPOSITORY_OWNER