ci: add base-up-to-date check

.github/workflows/base-up-to-date.yml

@@ -0,0 +1,49 @@
+name: base-up-to-date
+
+on:
+    pull_request:
+        types:
+            - opened
+            - reopened
+            - synchronize
+
+permissions:
+    contents: read
+
+concurrency:
+    group: base-up-to-date-pr-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    base-up-to-date:
+        name: base-up-to-date
+        runs-on: ubuntu-latest
+        timeout-minutes: 5
+        steps:
+            - name: Checkout pull request head
+              uses: actions/checkout@v4
+              with:
+                  ref: ${{ github.event.pull_request.head.sha }}
+                  fetch-depth: 0
+
+            - name: Check target branch is included
+              shell: bash
+              env:
+                  BASE_REF: ${{ github.event.pull_request.base.ref }}
+                  HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+              run: |
+                  set -euo pipefail
+
+                  target_ref='refs/remotes/origin/base-up-to-date-target'
+                  git fetch --no-tags origin "refs/heads/$BASE_REF:$target_ref"
+                  base_sha="$(git rev-parse "$target_ref^{commit}")"
+
+                  if git merge-base --is-ancestor "$base_sha" "$HEAD_SHA"; then
+                      printf 'PR head %s contains target branch %s at %s.\n' \
+                          "$HEAD_SHA" "$BASE_REF" "$base_sha"
+                      exit 0
+                  fi
+
+                  echo "::error title=Base branch is out of date::PR head $HEAD_SHA does not contain the latest $BASE_REF commit $base_sha."
+                  printf 'Update the PR branch with the latest %s commit, then push a new commit.\n' "$BASE_REF"
+                  exit 1