diff --git a/.ci/actions/upstream-sync/action.yml b/.ci/actions/upstream-sync/action.yml
new file mode 100644
index 00000000..67f66155
--- /dev/null
+++ b/.ci/actions/upstream-sync/action.yml
@@ -0,0 +1,64 @@
+name: 'Sync main-apache branch'
+description: 'Sync main-apache branch with upstream/main'
+
+inputs:
+  username:
+    description: 'Username for git'
+    required: false
+    default: kie-ci
+  useremail:
+    description: 'User email for git'
+    required: false
+    default: kie-ci0@redhat.com
+  upstream_remote:
+    description: 'URL of the upstream remote repository'
+    required: true
+  dry_run:
+    description: 'True to perform a dry run (dry run git push and skip create PR step)'
+    required: false
+    default: false
+
+runs:
+  if: github.repository_owner == 'kiegroup'
+  using: 'composite'
+  steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        ref: main
+
+    - name: Setup git environment
+      shell: bash
+      run: |
+        set -x
+        git config --global user.name "${{ inputs.username }}"
+        git config --global user.email "${{ inputs.useremail }}"
+        git remote add upstream ${{ inputs.upstream_remote }}
+
+    - name: Fetch all
+      shell: bash
+      run: git fetch --all --tags
+
+    - name: Checkout main-apache branch
+      shell: bash
+      run: git checkout --track origin/main-apache
+
+    - name: Pull main-apache branch
+      shell: bash
+      run: git pull
+
+    - name: Merge upstream/main branch
+      shell: bash
+      run: git merge --no-edit upstream/main
+
+    - name: Push changes
+      shell: bash
+      run: |
+        set -x
+        git push${{ inputs.dry_run == 'true' && ' --dry-run' || '' }}
+
+    - name: Push last tag
+      shell: bash
+      run: |
+        set -x
+        git push origin $(git tag --sort=creatordate | tail -n 1)${{ inputs.dry_run == 'true' && ' --dry-run' || '' }}