codeql-action/.github/workflows/update-release-branch.yml

name: Update release branch
on:
  # You can trigger this workflow via workflow dispatch to start a release.
  # This will open a PR to update the latest release branch.
  workflow_dispatch:

  # When a release is complete this workflow will open up backport PRs to older release branches.
  # NB while it will trigger on any release branch update, the backport job will not proceed for
  # anything other than than releases/v{latest}
  push:
    branches:
      - releases/*

defaults:
  run:
    shell: bash

jobs:

  prepare:
    name: "Prepare release"
    permissions:
      contents: read

    uses: ./.github/workflows/prepare-release.yml

  update:
    timeout-minutes: 45
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch'
    needs: [prepare]
    env:
      REF_NAME: "${{ github.ref_name }}"
      REPOSITORY: "${{ github.repository }}"
      MAJOR_VERSION: "${{ needs.prepare.outputs.major_version }}"
      LATEST_TAG: "${{ needs.prepare.outputs.latest_tag }}"
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull request
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        fetch-depth: 0  # Need full history for calculation of diffs
    - uses: ./.github/actions/release-initialise

    # when the workflow has been manually triggered on main,
    # we know that we definitely want the release branch to exist
    - name: Ensure release branch exists
      run: |
        echo "MAJOR_VERSION ${MAJOR_VERSION}"
        RELEASE_BRANCH=releases/${MAJOR_VERSION}
        if git checkout $RELEASE_BRANCH > /dev/null 2>&1; then
            echo "Branch $RELEASE_BRANCH already exists"
            echo ""
        else
            echo "Creating $RELEASE_BRANCH branch"
            git checkout -b ${RELEASE_BRANCH} ${LATEST_TAG}
            git push --set-upstream origin ${RELEASE_BRANCH}
            git branch --show-current
            echo ""
        fi
        echo "Returning to branch: ${REF_NAME}"
        git checkout ${REF_NAME}

    - name: Update current release branch
      if: github.event_name == 'workflow_dispatch'
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        echo SOURCE_BRANCH=${REF_NAME}
        echo TARGET_BRANCH=releases/${MAJOR_VERSION}
        npx tsx ./pr-checks/update-release-branch.ts \
          --repository-nwo ${{ github.repository }} \
          --source-branch '${{ env.REF_NAME }}' \
          --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
          --is-primary-release \
          --conductor ${GITHUB_ACTOR}

  backport:
    timeout-minutes: 45
    runs-on: ubuntu-latest
    environment: Automation
    needs: [prepare]
    if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
    strategy:
      fail-fast: false
      matrix:
        target_branch: ${{ fromJson(needs.prepare.outputs.backport_target_branches) }}
    env:
      SOURCE_BRANCH: ${{ needs.prepare.outputs.backport_source_branch }}
      TARGET_BRANCH: ${{ matrix.target_branch }}
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
        private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

    - name: Checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        fetch-depth: 0  # Need full history for calculation of diffs
        token: ${{ steps.app-token.outputs.token }}
    - uses: ./.github/actions/release-initialise

    - name: Update older release branch
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        echo SOURCE_BRANCH=${SOURCE_BRANCH}
        echo TARGET_BRANCH=${TARGET_BRANCH}
        npx tsx ./pr-checks/update-release-branch.ts \
          --repository-nwo ${{ github.repository }} \
          --source-branch ${SOURCE_BRANCH} \
          --target-branch ${TARGET_BRANCH} \
          --conductor ${GITHUB_ACTOR}