add workflow to update major tag

.gitea/workflows/update-major-tag.yaml

@@ -0,0 +1,37 @@
+name: Update major version tag
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  update-major-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out release tag
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Update floating major tag
+        shell: bash
+        env:
+          RELEASE_REF: ${{ gitea.ref }}
+        run: |
+          set -euo pipefail
+
+          release_tag="${RELEASE_REF#refs/tags/}"
+          if [[ ! "$release_tag" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            echo "Refusing to update a major tag from invalid release tag: $release_tag" >&2
+            exit 1
+          fi
+
+          major_tag="v${BASH_REMATCH[1]}"
+          git config user.name "Gitea Actions"
+          git config user.email "actions@localhost"
+          git tag --force --annotate "$major_tag" --message "Update $major_tag to $release_tag" "$release_tag"
+          git push origin "refs/tags/$major_tag" --force