CI: Add stable clobber (#4780)

Clobbers the `stable` branch with the `audited` tag as described in the
[RELEASE.md](https://github.com/paritytech/polkadot-sdk/blob/master/docs/RELEASE.md#clobbering).

Example of the `staging_stable` branch now after force-pushing the
`staging_audited` tag for a few times. The `staging_` prefix has now
been removed and should be ready for normal use.
The only trigger is currently manual, but can easily be set to three
months.
![Screenshot 2024-06-13 at 00 47
43](https://github.com/paritytech/polkadot-sdk/assets/10380170/97e070ad-ce2d-4504-83a0-ad6717b6e73e)

---------

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

.github/workflows/release-clobber-stable.yml

@@ -0,0 +1,70 @@
+name: Clobber Stable
+
+# This action implements the
+# [Clobbering](https://github.com/paritytech/polkadot-sdk/blob/master/docs/RELEASE.md#clobbering)
+# process from the release process. It pushes a new commit to the `stable` branch with all the
+# current content of the `audited` tag. It does not use a merge commit, but rather 'clobbers' the
+# branch with a single commit that contains all the changes. It has a naming scheme of `Clobber with
+# audited ($COMMIT)`.  
+# Currently, the script is only triggered manually, but can be easily changed to a schedule.
+
+on:
+  workflow_dispatch:
+
+permissions:
+    contents: write
+
+jobs:
+  clobber-stable:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+        STABLE: stable
+        UNSTABLE: master
+        AUDITED: audited
+    steps:
+    - name: Checkout
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+    - name: Prechecks
+      run: |
+        # Properly fetch
+        git fetch --prune --unshallow origin tag $AUDITED
+        git fetch origin $STABLE
+
+        # Sanity checks
+        git checkout -q tags/$AUDITED || (echo "Could not find the '$AUDITED' tag." && exit 1)
+        COMMIT=$(git rev-parse tags/$AUDITED)
+        #$(git branch --contains $COMMIT | grep -q $UNSTABLE) || (echo "The '$AUDITED' tag is not on the '$UNSTABLE' branch." && exit 1)
+
+        git config --global user.email "admin@parity.io"
+        git config --global user.name "Parity Release Team"
+
+    - name: Prepare commit
+      run: |
+        git checkout --quiet origin/$STABLE
+
+        # Delete all tracked files in the working directory
+        git ls-files -z | xargs -0 rm -f
+
+        # Find and delete any empty directories
+        find . -type d -empty -delete
+
+        git add . 1>/dev/null 2>/dev/null
+        git commit -qm "Delete all files"
+
+        # Grab the files from the commit
+        git checkout --quiet tags/$AUDITED -- .
+
+        # Stage, commit, and push the working directory which now matches 'audited' 1:1
+        git status
+        COMMIT=$(git rev-parse --short=10 tags/$AUDITED)
+        git add . 1>/dev/null 2>/dev/null
+        git commit --allow-empty --amend -qm "Clobber with $AUDITED ($COMMIT)"
+        
+    - name: Push stable branch
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        git log -3
+        git push --verbose origin HEAD:$STABLE

.github/workflows/release-srtool.yml

@@ -6,8 +6,6 @@ env:
 
 on:
   push:
-    tags:
-      - "*"
     branches:
       - release-v[0-9]+.[0-9]+.[0-9]+*
       - release-cumulus-v[0-9]+*