[infra] Integrate with external PR preview system (#19838)

Introduce a GitHub Action to monitor Pull Requests, storing relevant
information in the project's git repository (thus allowing the external
wptpr.live system to publish previews) and creating GitHub Deployments
(thus alerting contributors to the status of the preview). This Action
is triggered on a regular interval.

Introduce a second GitHub Action to monitor the state of the preview
system and communicate the relevant status to contributors via the Pull
Request UI. This Action is triggered for every GitHub Deployment created
in the previously-described Action.

For example, if three Pull Requests are updated, the first GitHub Action
will inspect them all. It will create GitHub Deployments only for the
"trusted" Pull Requests. A new GitHub Action will run for each of the
Deployments, polling the preview website until either the preview is
available or a timeout is reached. This Action will update the
deployment accordingly so that the author of each Pull Request author is
aware of the status of the preview site.

The following flow chart visually describes the same sequence:

                           sync
    gh-101 (trusted) --->   |
    gh-102 (untrusted) ->   |
    gh-103 (trusted) --->   |
                          .----.
                          |sync|--------+---------------------.
                          '----'        |                     |
                                 .-------------.       .-------------.
                                 |deploy gh-101|       |deploy gh-103|
                                 '-------------'       '-------------'
                                        |                     |
                                 poll for preview      poll for preview
                                        |                     |
    gh-101 <------ success ----- preview available     poll for preview
                                                              |
    gh-103 <------- error --------------------------------- timeout

.github/workflows/detect_pull_request_preview.yml

@@ -0,0 +1,24 @@
+name: pr-preview-detect
+on: deployment
+jobs:
+  detect-deployment:
+    runs-on: ubuntu-18.04
+    steps:
+    - uses: actions/checkout@v1
+      # By default, the "checkout" Action will attempt to check out the
+      # revision to be deployed. Because it does not fetch GitHub Pull Request
+      # branches, this will fail.
+      with:
+        ref: refs/heads/master
+    - name: Install dependency
+      run: pip install requests
+    - name: Detect deployment
+      run:
+        ./tools/ci/pr_preview.py
+          --host https://api.github.com
+          --github-project web-platform-tests/wpt
+          detect
+          --target https://wptpr.live
+          --timeout 600
+      env:
+        GITHUB_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

.github/workflows/pull_request_previews.yml

@@ -0,0 +1,29 @@
+name: pr-preview-sync
+on:
+  schedule:
+    - cron: */5 * * * *
+jobs:
+  update-pr-preview:
+    runs-on: ubuntu-18.04
+    steps:
+    - uses: actions/checkout@v1
+      with:
+        fetch-depth: 1
+    - name: Install dependency
+      run: pip install requests
+    - name: Synchronize state
+      run:
+        ./tools/ci/pr_preview.py
+          --host https://api.github.com
+          --github-project web-platform-tests/wpt
+          synchronize
+          --window 480
+      env:
+        # This Workflow must trigger further workflows. The GitHub-provided
+        # `GITHUB_TOKEN` secret is incapable of doing this [1], so a
+        # user-generated token must be specified instead. This token requires
+        # the "repo" scope, and is should be stored as a Secret named
+        # "DEPLOY_TOKEN" in this GitHub project.
+        #
+        # [1] https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows
+        GITHUB_TOKEN: ${{ secrets.DEPLOY_TOKEN }}