add vendor update job

.github/workflows/update-vendor-license.yml

@@ -0,0 +1,77 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "Update vendor licenses"
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ master, 'release-**' ]
+    paths:
+      - 'go.*'
+  schedule:
+    - cron: '0 */4 * * *'
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
+      with:
+        egress-policy: audit
+
+    - name: Checkout repository
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+    - name: Set up Go 1.x
+      uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+      with:
+        go-version: '>=1.20'
+        check-latest: true
+      id: go
+
+    - name: Autobuild
+      run: |
+        make update
+    - name: Create Pull Request
+      uses: peter-evans/create-pull-request@v5
+      with:
+        branch: doc/update-vendorlicense-${{github.ref_name}}
+        delete-branch: true
+        labels: |
+            lgtm
+            approved
+        commit-message: Update vendor license for ${{github.ref_name}}
+        body: |
+            Auto-generated by GitHub Action [Update vendor licenses](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}})
+
+            #### What type of PR is this?
+            /kind testing
+
+            #### What this PR does / why we need it:
+            New release published.
+
+            #### Does this PR introduce a user-facing change?
+            ```release-note
+            None
+            ```