Create update-required-checks script

This also removes the .github/workflows/update-required-checks.yml
workflow. This script needs to be run locally by someone who has
admin privileges on the repo.

.github/workflows/script/update-required-checks.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Update the required checks based on the current branch.
+# Typically, this will be main.
+
+# NOTE: This script can only be run by someone with admin rights on this repo.
+
+if [ "$#" -eq 1 ]; then
+  # If we were passed an argument, pass it as a query to fzf
+  GITHUB_SHA="$@"
+elif [ "$#" -gt 1 ]; then
+  echo "Usage: $0 [SHA]"
+  echo "Update the required checks based on the SHA, or main."
+elif [ -z "$GITHUB_SHA" ]; then
+  # If we don't have a SHA, use main
+  GITHUB_SHA="$(git rev-parse main)"
+fi
+
+echo "Getting checks for $GITHUB_SHA"
+
+# Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
+CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") | not)] | sort')"
+
+echo "$CHECKS" | jq
+
+echo "{\"contexts\": ${CHECKS}}" > checks.json
+echo "Updating main"
+gh api --silent -X "PATCH" repos/github/codeql-action/branches/main/protection/required_status_checks --input checks.json
+echo "Updating v2"
+gh api --silent -X "PATCH" repos/github/codeql-action/branches/releases/v2/protection/required_status_checks --input checks.json
+echo "Updating v1"
+gh api --silent -X "PATCH" repos/github/codeql-action/branches/releases/v1/protection/required_status_checks --input checks.json
+
+rm check.json