feat: add a workflow to create sync PRs

.github/workflows/sync-with-upstream.yaml

@@ -0,0 +1,81 @@
+# Create a PR to sync with the upstream template repo.
+# The template repo is https://github.com/jenstroeger/python-package-template.
+
+name: Sync with template repository
+on:
+  schedule:
+  - cron: 11 11 * * *
+
+permissions:
+  contents: read
+env:
+  # This is the username and email for the user who creates a branch and commits
+  # the changes. In an organisation that should be a dedicated devops account.
+  USER_NAME: jenstroeger
+  USER_EMAIL: jenstroeger@users.noreply.github.com
+
+jobs:
+  sync:
+    if: github.repository != 'jenstroeger/python-package-template'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+
+    - name: Check out template repository
+      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      with:
+        # If you decide to change the upstream template repository to a private one, uncomment
+        # the following argument to pass the required token to be able to check it out.
+        # token: ${{ secrets.<TEMPLATE_REPO_TOKEN> }}
+        repository: jenstroeger/python-package-template
+        fetch-depth: 0
+        path: template
+
+    - name: Check out current repository
+      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      with:
+        token: ${{ secrets.REPO_ACCESS_TOKEN }}
+        fetch-depth: 0
+        ref: main
+        path: repo
+
+    - name: Sync with template
+      env:
+        GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
+      run: |
+        LATEST_VERSION=$(cd template && git describe --tags --abbrev=0)
+        CURRENT_VERSION=$(test -f repo/.github/workflows/.template_version \
+          && cat repo/.github/workflows/.template_version || echo "v0.0.0")
+        echo "Latest version is $LATEST_VERSION and current version is $CURRENT_VERSION."
+
+        if [ $CURRENT_VERSION == $LATEST_VERSION ]; then
+          echo "Unable to find a new version, exiting..."
+        else
+
+          # Copy the files from the template to the current repo.
+          rsync --recursive --verbose --verbose --exclude tests/ --exclude src/ \
+            --exclude .git/ --exclude .github/workflows/.template_version template/ repo/
+
+          # Check if the branch exists in the current repo.
+          cd repo/
+          if [ $(git rev-parse --verify origin/sync-$LATEST_VERSION 2>/dev/null) ]; then
+            echo "Branch sync-$LATEST_VERSION already exists. Exiting..."
+            exit 0
+          fi
+
+          # Create a branch, commit, and push the changeset.
+          git checkout -b sync-$LATEST_VERSION
+          echo $LATEST_VERSION > .github/workflows/.template_version
+          git add .
+          git config --global user.name $USER_NAME
+          git config --global user.email $USER_EMAIL
+          git config --list --global # For debug purposes.
+          git commit -m "chore: sync with template"
+          git push --set-upstream origin sync-$LATEST_VERSION
+
+          # Create the pull request.
+          gh pr create --base main --title "chore: sync with package template $LATEST_VERSION" \
+            --body "This PR was automatically generated." --head sync-$LATEST_VERSION
+        fi

README.md

@@ -20,6 +20,7 @@ This repository is intended to be a base template, a cookiecutter for a new Pyth
 [Git hooks](#git-hooks)  
 [Testing](#testing)  
 [Generating documentation](#generating-documentation)  
+[Synchronizing with this template repo](#synchronizing-with-this-template-repo)  
 [Versioning, publishing and changelog](#versioning-publishing-and-changelog)  
 [Build integrity using SLSA framework](#build-integrity-using-slsa-framework)  
 [Cleaning up](#cleaning-up)  
@@ -90,7 +91,7 @@ If you’d like to start your own Python project from scratch, you can either co
 - Adjust the Dependabot settings in `.github/dependabot.yaml` to your desired target branch that you’d like to have monitored by Dependabot.
 
 - Create the following [Personal Access Tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) (PAT) with certain [scopes](https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps#available-scopes) for your Github user account and then [create secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository) for the new Github repository whose values are these new PATs:
-  - one PAT with `repo` scope (including _all_ of the `repo` permissions) for the secret named `REPO_ACCESS_TOKEN`; this secret is used by the [Release Action](https://github.com/jenstroeger/python-package-template/blob/main/.github/workflows/release.yaml) to push the release commit and attach assets to the generated [Github release](https://github.com/jenstroeger/python-package-template/releases).
+  - one PAT with `workflow` and `repo` scope (including _all_ of the `repo` permissions) for the secret named `REPO_ACCESS_TOKEN`; this secret is used by the [Release Action](https://github.com/jenstroeger/python-package-template/blob/main/.github/workflows/release.yaml) to push the release commit and attach assets to the generated [Github release](https://github.com/jenstroeger/python-package-template/releases).
   - one PAT with `public_repo`, `read:discussion`, `read:org`, and `read:repo_hook` scopes ([detailed docs](https://github.com/ossf/scorecard-action#authentication-with-pat-optional)) for the secret named `SCORECARD_READ_TOKEN`; this secret is used by the [Scorecard Action](https://github.com/jenstroeger/python-package-template/blob/main/.github/workflows/scorecards-analysis.yaml) to analyze the code and add its results to your repository.
   - one PAT with `repo` scope for the secret named `DEPENDABOT_AUTOMERGE_TOKEN`; this secret is used by the [Dependabot Automerge Action](https://github.com/jenstroeger/python-package-template/blob/main/.github/workflows/dependabot-automerge.yaml) to comment on Dependabot PRs.
 - Create a Wiki and a first empty Wiki page for your new repository. Using the [Wiki Documentation](https://github.com/jenstroeger/python-package-template/blob/main/.github/workflows/_wiki-documentation.yaml) Action the repository’s Wiki will be automatically updated as part of publishing a new release.
@@ -226,6 +227,10 @@ open docs/_build/html/index.html
 
 In addition to the default HTML, Sphinx also generates Markdown documentation compatible with [Github Wiki](https://docs.github.com/en/communities/documenting-your-project-with-wikis), and the [Wiki Documentation](https://github.com/jenstroeger/python-package-template/blob/main/.github/workflows/_wiki-documentation.yaml) Action automatically updates the project repository’s Wiki.
 
+## Synchronizing with this template repo
+
+The [sync-with-upstream.yaml](https://github.com/jenstroeger/python-package-template/blob/main/.github/workflows/sync-with-upstream.yaml) GitHub Acions workflow checks this template repo daily and automatically creates a pull request in the downstream repo if there is a new release. Make sure to set up the GitHub username and email address in this workflow accordingly.
+
 ## Versioning, publishing and changelog
 
 To enable automation for [semantic versioning](https://semver.org/), package publishing, and changelog generation it is important to use meaningful [conventional commit messages](https://www.conventionalcommits.org/)! This package template already has a built-in semantic release support enabled which is set up to take care of all three of these aspects — every time changes are merged into the `main` branch.