chore: workflow to automatically request a deployment to the test-pipeline (#26496)

Creates a workflow that will request a GitHub Environment deployment whenever cli files change.
The deployment has to be approved by a team member to run.
The actual code to deploy is just a push to the `test-main-pipeline` branch, thus reusing the existing functionality.
Workflow tested on my fork.

When change has been detected:
<img width="883" alt="image" src="https://github.com/aws/aws-cdk/assets/379814/8b7951ec-0256-4ebf-ac60-39b82ab6a712">
After approval:
<img width="874" alt="image" src="https://github.com/aws/aws-cdk/assets/379814/6f3ce6f1-9c3b-44b3-bbfb-d0804c18f9dc">
After request submitted:
<img width="949" alt="image" src="https://github.com/aws/aws-cdk/assets/379814/47920d0e-4a78-4a90-8be8-031ab0480d6b">


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: mrgrain

.github/workflows/request-cli-integ-test.yml

@@ -0,0 +1,56 @@
+# Request a deployment to the test pipeline
+
+name: request-cli-integ-test
+on:
+  pull_request_target: {}
+
+jobs:
+  cli-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      any-changed-files: ${{ steps.changed-cli-files.outputs.cli_any_changed }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Find changed cli files
+        id: changed-cli-files
+        uses: tj-actions/changed-files@v37
+        with:
+          files_yaml: |
+            cli:
+              - packages/aws-cdk/bin/**
+              - packages/aws-cdk/lib/**
+              - packages/aws-cdk/test/**
+  submit-to-test-pipeline:
+    environment: test-pipeline
+    needs: cli-changes
+    if: needs.cli-changes.outputs.any-changed-files == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+      - name: Submit to test-pipeline
+        # Needs to run with PROJEN_GITHUB_TOKEN because we need permissions to force push the branch
+        run: |
+          git config --global user.name 'aws-cdk-automation'
+          git config --global user.email '[email protected]'
+          git push --force --atomic https://oauth2:${{ secrets.PROJEN_GITHUB_TOKEN }}@github.com/${{ github.repository }}.git FETCH_HEAD:test-main-pipeline
+      - name: Explain next steps
+        uses: thollander/actions-comment-pull-request@v2
+        with:
+          message: |
+            :arrow_right: **PR build request submitted to `test-main-pipeline`** :arrow_left:
+
+            A maintainer must now manually check the pipeline and add the `pr-linter/cli-integ-tested` label once the pipeline succeeds.
+          comment_tag: request-cli-integ-test
+          mode: recreate
+          # Post as our automation user
+          GITHUB_TOKEN: ${{ secrets.PROJEN_GITHUB_TOKEN }}