ci: add workflow to keep version tags pointing at branch heads

Maps branches to floating version tags so RTD can build canonical
versioned URLs from a single ref name regardless of branch renames:

- current  -> rolling
- circinus -> 1.5
- sagitta  -> 1.4

The workflow force-moves the matching tag to the pushed SHA on every
push to one of the three branches. Initial seed tags were created
manually; subsequent updates are automatic.

🤖 Generated by [robots](https://vyos.io)

1 files changed, 38 insertions, 0 deletions

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
new file mode 100644
index 00000000..4a781c4f
--- /dev/null
+++ b/.github/workflows/update-version-tags.yml
@@ -0,0 +1,38 @@
+name: Update version tags
+
+on:
+  push:
+    branches:
+      - current
+      - circinus
+      - sagitta
+
+permissions:
+  contents: write
+
+jobs:
+  retag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Move version tag to pushed SHA
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          case "$BRANCH" in
+            current)  TAG=rolling ;;
+            circinus) TAG=1.5 ;;
+            sagitta)  TAG=1.4 ;;
+            *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;;
+          esac
+          echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)"
+          if gh api "repos/$REPO/git/refs/tags/$TAG" >/dev/null 2>&1; then
+            gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \
+              -f sha="$SHA" -F force=true
+          else
+            gh api -X POST "repos/$REPO/git/refs" \
+              -f ref="refs/tags/$TAG" -f sha="$SHA"
+          fi