workflows/bot: migrate nixpkgs-merge-bot to GHA

Running the nixpkgs-merge-bot in GitHub Actions instead of a separate
workflow has multiple advantages:
- A much better development workflow, with improved testability.
- The ability to label PRs with a "merge-bot eligible" label from the
same codebase.
- Using more data for merge strategy decisions, for example the number
of rebuilds.

This commits re-implements most of the features from the current
nxipkgs-merge-bot directly in the bot workflow. Instead of reacting to
webhook events, this now runs on the regular 10 minute schedule. Some
merges might be delayed a few minutes, but that should not be a problem
in practice.

To give the user early feedback, there are additional workflows running
when a comment or review is posted. These react with "eyes" to make the
user aware that the comment has been recognized.

The only feature not taken over was the size check for files in the PR.
This kind of check is not really relevant for maintainer merges only -
if we want to prevent bigger files from making it into the tree, then we
need a generic CI check, which is out of scope for the merge-bot.

Other than that, everything should be implemented - any omissions are by
accident.

ci/github-script/bot.js

@@ -4,6 +4,7 @@ module.exports = async ({ github, context, core, dry }) => {
   const { readFile, writeFile } = require('node:fs/promises')
   const withRateLimit = require('./withRateLimit.js')
   const { classify } = require('../supportedBranches.js')
+  const { handleMerge } = require('./merge.js')
 
   const artifactClient = new DefaultArtifactClient()
 
@@ -95,7 +96,7 @@ module.exports = async ({ github, context, core, dry }) => {
     return maintainerMaps[branch]
   }
 
-  async function handlePullRequest({ item, stats }) {
+  async function handlePullRequest({ item, stats, events }) {
     const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
     const pull_number = item.number
@@ -109,6 +110,19 @@ module.exports = async ({ github, context, core, dry }) => {
       })
     ).data
 
+    const maintainers = await getMaintainerMap(pull_request.base.ref)
+
+    await handleMerge({
+      github,
+      context,
+      core,
+      log,
+      dry,
+      pull_request,
+      events,
+      maintainers,
+    })
+
     // When the same change has already been merged to the target branch, a PR will still be
     // open and display the same changes - but will not actually have any effect. This causes
     // strange CI behavior, because the diff of the merge-commit is empty, no rebuilds will
@@ -305,8 +319,6 @@ module.exports = async ({ github, context, core, dry }) => {
         )
       }
 
-      const maintainers = await getMaintainerMap(pull_request.base.ref)
-
       Object.assign(prLabels, evalLabels, {
         '11.by: package-maintainer':
           packages.length &&
@@ -377,9 +389,21 @@ module.exports = async ({ github, context, core, dry }) => {
 
       const itemLabels = {}
 
+      const events = await github.paginate(
+        github.rest.issues.listEventsForTimeline,
+        {
+          ...context.repo,
+          issue_number,
+          per_page: 100,
+        },
+      )
+
       if (item.pull_request || context.payload.pull_request) {
         stats.prs++
-        Object.assign(itemLabels, await handlePullRequest({ item, stats }))
+        Object.assign(
+          itemLabels,
+          await handlePullRequest({ item, stats, events }),
+        )
       } else {
         stats.issues++
         if (item.labels.some(({ name }) => name === '4.workflow: auto-close')) {
@@ -391,13 +415,7 @@ module.exports = async ({ github, context, core, dry }) => {
       }
 
       const latest_event_at = new Date(
-        (
-          await github.paginate(github.rest.issues.listEventsForTimeline, {
-            ...context.repo,
-            issue_number,
-            per_page: 100,
-          })
-        )
+        events
           .filter(({ event }) =>
             [
               // These events are hand-picked from: