ci: port merge-to-stage / merge-to-main automation from da-express-milo

[hadobe]

Summary

Ports the Milo-pattern stage → main release automation into edu, mirroring what already runs in da-express-milo. Added files:

• .github/workflows/merge-to-stage.{yaml,js} — batches labeled PRs into stage, opens the [Release] Stage to Main PR
• .github/workflows/merge-to-main.{yaml,js} — promotes that release PR to main
• .github/workflows/helpers.js — shared Octokit/RCP/working-hours helpers
• package.json / package-lock.json — adds @octokit/rest@^20.0.2 (required by helpers.js)

Both workflows run on a 2-hour cron + workflow_dispatch + repository_dispatch.

Why this is low-risk to land now

edu already matches the conventions the scripts assume — verified before porting:

• ✅ stage (default) and main branches exist
• ✅ All gating labels already exist: Ready for Stage, QA Approved, Design Review Complete, Design Review Not Required, Ready for Review, zero-impact
• ✅ Squash-merge (stage) and merge-commit (main) both enabled
• ✅ No existing merge-to-stage/main workflow to conflict with

The scripts fail closed — if config/secrets/labels are missing they log and merge nothing.

⚠️ Required before this can actually merge anything (admin-side, NOT in this PR)

This PR is intentionally a draft because the workflows are inert until an edu repo/org admin wires up:

1. GitHub App install on edu providing EXPRESS_MERGE_APP_ID + EXPRESS_MERGE_PRIVATE_KEY with PR-merge permission.
2. express_pr_merge environment + secrets: REQUIRED_APPROVALS, MAX_PRS_PER_BATCH, STAGE_RCP_OFFSET_DAYS, MAIN_RCP_OFFSET_DAYS.
3. Branch protection on stage/main allowing the App to merge.

Decisions carried over from source (flag if you disagree)

• Secret names kept as EXPRESS_MERGE_* to minimize divergence from da-express-milo and ease future syncs. Rename here if edu provisions a distinct app.
• helpers.js RCP calendar is copied verbatim, so edu currently inherits Express's release-freeze windows and the "blocks all merges after the last listed date" behavior. Decide whether edu should own its own calendar + a maintainer.
• ignoreChecks still lists aem-psi-check / merge-to-*; review against edu's actual required check names.
• Test URLs in the stage-PR body were updated to *--edu--adobecom.aem.page/edu/.

Open question for the edu team

edu has a kodiak-stage branch — please confirm Kodiak (or any other auto-merge) is not currently merging to stage/main, so we don't end up with two systems merging at once.

🤖 Generated with Claude Code

[aem-code-sync]

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.

• Re-run all PSI checks
• Re-run failed PSI checks
• Re-sync branch

Commits

• 5142dcb ✅ (latest)