ci: Add 1.x sync and bundle branch automation for n8n-private (#27594)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/sec-sync-public-to-private.yml

@@ -39,7 +39,7 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
 
-      - name: Sync from public
+      - name: Sync master from public
         run: |
           git fetch https://github.com/n8n-io/n8n.git master:public-master
 
@@ -60,3 +60,48 @@ jobs:
 
           git reset --hard public-master
           git push origin master --force-with-lease
+
+      - name: Sync 1.x from public
+        run: |
+          git fetch https://github.com/n8n-io/n8n.git 1.x:public-1.x
+          git checkout 1.x
+
+          # Check if private is ahead of public, ignore Bundle commits
+          AHEAD_COUNT=$(git rev-list public-1.x..HEAD --pretty=oneline --grep="chore: Bundle" --invert-grep --count)
+
+          if [ "$AHEAD_COUNT" -gt 0 ]; then
+            if [ "${{ github.event_name }}" = "schedule" ]; then
+              echo "Private 1.x is $AHEAD_COUNT commit(s) ahead of public, skipping scheduled sync"
+              exit 0
+            elif [ "${{ inputs.force }}" != "true" ]; then
+              echo "Private 1.x is $AHEAD_COUNT commit(s) ahead of public, skipping (force not enabled)"
+              exit 0
+            else
+              echo "Private 1.x is $AHEAD_COUNT commit(s) ahead of public, force syncing anyway"
+            fi
+          fi
+
+          git reset --hard public-1.x
+          git push origin 1.x --force-with-lease
+
+      - name: Ensure bundle/2.x exists
+        run: |
+          if git ls-remote --exit-code origin refs/heads/bundle/2.x; then
+            echo "bundle/2.x already exists, skipping"
+          else
+            echo "bundle/2.x not found, creating from master"
+            git checkout master
+            git checkout -b bundle/2.x
+            git push origin bundle/2.x
+          fi
+
+      - name: Ensure bundle/1.x exists
+        run: |
+          if git ls-remote --exit-code origin refs/heads/bundle/1.x; then
+            echo "bundle/1.x already exists, skipping"
+          else
+            echo "bundle/1.x not found, creating from 1.x"
+            git checkout 1.x
+            git checkout -b bundle/1.x
+            git push origin bundle/1.x
+          fi

.github/workflows/util-backport-bundle.yml

@@ -0,0 +1,72 @@
+name: 'Util: Backport bundle PR to bundle/1.x'
+
+run-name: Backport pull request ${{ github.event.pull_request.number || inputs.pull-request-id }}
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - 'bundle/2.x'
+  workflow_dispatch:
+    inputs:
+      pull-request-id:
+        description: 'The ID number of the pull request (e.g. 3342). No #, no extra letters.'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  backport:
+    if: |
+      github.repository == 'n8n-io/n8n-private' &&
+      (github.event.pull_request.merged == true ||
+      github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-slim
+    steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.N8N_ASSISTANT_APP_ID }}
+          private-key: ${{ secrets.N8N_ASSISTANT_PRIVATE_KEY }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+          fetch-depth: 0
+
+      - name: Backport
+        uses: korthout/backport-action@4aaf0e03a94ff0a619c9a511b61aeb42adea5b02 # v4.2.0
+        with:
+          github_token: ${{ steps.generate-token.outputs.token }}
+          source_pr_number: ${{ github.event.pull_request.number || inputs.pull-request-id }}
+          target_branches: bundle/1.x
+          pull_description: |-
+            # Description
+            Backport of #${pull_number} to `${target_branch}`.
+
+            ## Checklist for the author (@${pull_author}) to go through.
+
+            - [ ] Review the backport changes
+            - [ ] Fix possible conflicts
+            - [ ] Merge to target branch
+
+            After this PR has been merged, it will be picked up in the next patch release for release track.
+
+            # Original description
+
+            ${pull_description}
+          pull_title: ${pull_title} (backport to ${target_branch})
+          add_author_as_assignee: true
+          add_author_as_reviewer: true
+          copy_assignees: true
+          copy_requested_reviewers: false
+          copy_labels_pattern: '^(?!Backport to\b).+'
+          add_labels: 'automation:backport'
+          experimental: >
+            {
+              "conflict_resolution": "draft_commit_conflicts"
+            }