feat: auto-update open PR branches after merge to main

When a PR merges, the post-merge workflow now iterates all open PRs
and runs gh pr update-branch on each. This eliminates the manual
'Update branch' click when strict status checks require branches
to be up to date.

Also enabled allow_update_branch on the repo via API.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

.github/workflows/post-merge.yml

@@ -19,6 +19,7 @@ jobs:
     if: github.event.pull_request.merged == true
     permissions:
       actions: write
+      contents: write
     steps:
       - name: Harden runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -32,3 +33,13 @@ jobs:
           gh workflow run ci.yml --ref main --repo "${{ github.repository }}"
           gh workflow run security.yml --ref main --repo "${{ github.repository }}"
           gh workflow run scorecard.yml --ref main --repo "${{ github.repository }}"
+
+      - name: Auto-update open PR branches
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr list --base main --state open --json number --jq '.[].number' \
+            --repo "${{ github.repository }}" | while read -r pr; do
+            echo "Updating PR #$pr"
+            gh pr update-branch "$pr" --repo "${{ github.repository }}" || true
+          done