chore: import upstream snapshot with attribution

.github/workflows/rerun-workflow-run.yml

@@ -0,0 +1,59 @@
+# Triggered by rerun.yml on PR approval.
+name: rerun-workflow-run
+on:
+  workflow_run:
+    workflows: [rerun]
+    types: [completed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+permissions: {}
+
+jobs:
+  rerun:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    permissions:
+      actions: write # to rerun github action workflows
+    steps:
+      - name: Rerun failed checks
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          gh run download "$RUN_ID" -n pr_number -D /tmp/pr
+          pr_number=$(cat /tmp/pr/pr_number)
+
+          head_sha=$(gh pr view "$pr_number" --json headRefOid --jq .headRefOid)
+
+          # Rerun failed github-actions check runs on the PR head, excluding the
+          # rerun workflow itself (to prevent recursion). Always rerun "protect";
+          # otherwise only rerun jobs that took <= 60s (e.g. the approval check).
+          run_ids=$(
+            gh api --paginate "repos/$GH_REPO/commits/$head_sha/check-runs?per_page=100" \
+              --jq '.check_runs[]
+                | select(.app.slug == "github-actions")
+                | select(.status == "completed")
+                | select(.conclusion == "failure")
+                | select((.name | ascii_downcase) != "rerun")
+                | select(
+                    (.name | ascii_downcase) == "protect"
+                    or ((.completed_at | fromdateiso8601) - (.started_at | fromdateiso8601)) <= 60
+                  )
+                | .html_url
+                | capture("/actions/runs/(?<id>[0-9]+)").id' \
+              | sort -u
+          )
+
+          for id in $run_ids; do
+            echo "Rerunning https://github.com/$GH_REPO/actions/runs/$id"
+            gh run rerun "$id" --failed --repo "$GH_REPO" || echo "Failed to rerun $id"
+          done