release-pr.yml

name: Release PR

on:
  push:
    branches:
      - main
      - release
  pull_request:
    types:
      - closed
    branches:
      - release
  workflow_dispatch:
    inputs:
      bump:
        description: Version bump to use for the next release PR
        type: choice
        default: minor
        options:
          - patch
          - minor
          - major

permissions:
  actions: write
  contents: write
  issues: write
  pull-requests: write

env:
  AUTOMATION_BRANCH_PREFIX: automation/release
  RELEASE_BASE: release
  RELEASE_HEAD: main
  RELEASE_LABEL: release-pr

jobs:
  maintain-release-pr:
    name: Maintain release PR
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'push' &&
        (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release'))
    runs-on: blacksmith-2vcpu-ubuntu-2404
    concurrency:
      group: release-pr-maintain
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Create or update release PR
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUMP_KIND: ${{ github.event.inputs.bump || 'minor' }}
        run: |
          set -euo pipefail

          git fetch origin "$RELEASE_HEAD" "$RELEASE_BASE" --tags

          repo_owner="${GITHUB_REPOSITORY%/*}"

          find_existing_pr_for_branch() {
            local branch="$1"
            gh pr list \
              --base "$RELEASE_BASE" \
              --state open \
              --json number,headRefName,headRepositoryOwner \
              --jq ".[] | select(.headRefName == \"$branch\") | select(.headRepositoryOwner.login == \"$repo_owner\") | .number" \
              | head -n 1
          }

          find_automation_prs() {
            gh pr list \
              --base "$RELEASE_BASE" \
              --state open \
              --json number,headRefName,headRepositoryOwner \
              --jq ".[] | select(.headRepositoryOwner.login == \"$repo_owner\") | select(.headRefName == \"$AUTOMATION_BRANCH_PREFIX\" or (.headRefName | startswith(\"$AUTOMATION_BRANCH_PREFIX/\"))) | [.number, .headRefName] | @tsv"
          }

          commits_ahead=$(git rev-list --count "origin/$RELEASE_BASE..origin/$RELEASE_HEAD")

          if [ "$commits_ahead" -eq 0 ]; then
            echo "No commits from $RELEASE_HEAD to release."
            find_automation_prs | while IFS=$'\t' read -r pr_number pr_head; do
              if [ -n "$pr_number" ]; then
                gh pr close "$pr_number" \
                  --comment "Closing because there are no unreleased commits from $RELEASE_HEAD." \
                  --delete-branch </dev/null || \
                  echo "::warning::Failed to close stale release PR #$pr_number"
              fi
            done
            exit 0
          fi

          latest_tag=$(git tag --list 'v*' --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || true)
          if [ -z "$latest_tag" ]; then
            latest_tag="v0.0.0"
          fi

          version_without_prefix="${latest_tag#v}"
          IFS=. read -r major minor patch <<EOF
          $version_without_prefix
          EOF

          case "$BUMP_KIND" in
            major)
              major=$((major + 1))
              minor=0
              patch=0
              ;;
            minor)
              minor=$((minor + 1))
              patch=0
              ;;
            patch)
              patch=$((patch + 1))
              ;;
            *)
              echo "Unsupported bump kind: $BUMP_KIND" >&2
              exit 1
              ;;
          esac

          next_version="v${major}.${minor}.${patch}"
          automation_branch="$AUTOMATION_BRANCH_PREFIX/$next_version"
          echo "Preparing $next_version from latest tag $latest_tag."

          find_automation_prs | while IFS=$'\t' read -r pr_number pr_head; do
            if [ -n "$pr_number" ] && [ "$pr_head" != "$automation_branch" ]; then
              gh pr close "$pr_number" \
                --comment "Closing because release automation now uses $automation_branch for $next_version." \
                --delete-branch </dev/null || \
                echo "::warning::Failed to close stale release PR #$pr_number"
            fi
          done

          existing_pr=$(find_existing_pr_for_branch "$automation_branch")

          gh label create "$RELEASE_LABEL" \
            --color "0e8a16" \
            --description "Automated release PR" \
            --force

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git checkout -B "$automation_branch" "origin/$RELEASE_HEAD"

          git push --force origin "$automation_branch"

          body=$(cat <<EOF
          Automated release PR.

          Version: $next_version
          Base: $RELEASE_BASE
          Source: $RELEASE_HEAD

          Merging this PR will tag the merge commit as $next_version and dispatch the release workflow.
          EOF
          )

          if [ -n "$existing_pr" ]; then
            gh pr edit "$existing_pr" \
              --title "Release $next_version" \
              --body "$body" \
              --add-label "$RELEASE_LABEL"
          else
            if ! gh pr create \
              --base "$RELEASE_BASE" \
              --head "$automation_branch" \
              --title "Release $next_version" \
              --body "$body" \
              --label "$RELEASE_LABEL" \
              --draft; then
              existing_pr=$(find_existing_pr_for_branch "$automation_branch")
              if [ -n "$existing_pr" ]; then
                echo "Release PR #$existing_pr already exists; updating it instead."
                gh pr edit "$existing_pr" \
                  --title "Release $next_version" \
                  --body "$body" \
                  --add-label "$RELEASE_LABEL"
                exit 0
              fi
              exit 1
            fi
          fi

  tag-merged-release-pr:
    name: Tag merged release PR
    if: >-
      github.event_name == 'pull_request' &&
      github.event.action == 'closed' &&
      github.event.pull_request.merged == true &&
      github.event.pull_request.base.ref == 'release' &&
      startsWith(github.event.pull_request.head.ref, 'automation/release/')
    runs-on: blacksmith-2vcpu-ubuntu-2404
    concurrency:
      group: release-tag-${{ github.event.pull_request.merge_commit_sha }}
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Tag merge commit and dispatch release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          set -euo pipefail

          git fetch origin "$RELEASE_BASE" --tags

          if [ -z "$MERGE_SHA" ]; then
            echo "Merged PR does not have a merge_commit_sha." >&2
            exit 1
          fi

          version="${HEAD_REF#automation/release/}"
          if ! echo "$version" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "Release PR head branch does not include a valid release version: $HEAD_REF" >&2
            exit 1
          fi

          if git rev-parse -q --verify "refs/tags/$version" >/dev/null; then
            echo "Tag $version already exists; not tagging again."
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "$version" "$MERGE_SHA" -m "Release $version"
          git push origin "refs/tags/$version"

          gh workflow run release.yml --ref "$version"