release-branch.yaml

# This creates a new release branch from the main branch.
# It serves as the cutoff point for the next minor release.
# From this point onward only bug fixes and critical changes will be accepted onto the release
# branch as backports from main. At the same time, the main branch will be open for new features
# and changes for the next minor release.
name: Release Branch Cutoff

on:
  workflow_dispatch:

permissions:
  # Necessary to write the branch
  contents: write

jobs:
  cutoff-preconditions:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      repository-projects: read
    outputs:
      minor: ${{ steps.get-minor.outputs.minor }}
      branch: ${{ steps.verify-branch.outputs.branch }}
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.OCMBOT_APP_ID }}
          private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: '${{ github.workspace }}/go.mod'
          cache: false
      - name: Get Minor
        id: get-minor
        run: |
          set -e
          minor="$(go run ./api/version/generate print-major-minor)"
          echo "minor=$minor" >> $GITHUB_OUTPUT
          echo "Current Major-Minor Version: $minor"
      - name: Verify Branch does not exist
        id: verify-branch
        run: |
          set -e
          minor="v${{ steps.get-minor.outputs.minor }}"
          branch="releases/$minor"
          if git ls-remote --exit-code origin refs/heads/$branch ; then
            >&2 echo "branch $branch already exists, aborting"
            exit 1
          fi
          echo "branch $branch does not exist"
          echo "branch=$branch" >> $GITHUB_OUTPUT

  create-branch:
    runs-on: ubuntu-latest
    needs: cutoff-preconditions
    permissions:
      contents: write
      id-token: write
      repository-projects: read
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.OCMBOT_APP_ID }}
          private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}
      - name: Setup git config
        run: |
          git config user.name "GitHub Actions Bot"
          git config user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
      # tag the cutoff point in main so that it can be used for release note generation
      - name: Create Cutoff Tag in Main
        run: |
          set -e
          tag="v${{ needs.cutoff-preconditions.outputs.minor }}"
          msg="Cutoff for $tag"
          git tag --annotate --message "${msg}" "$tag"
          git push origin "$tag"
      # create a new branch
      - name: Create Release Branch
        run: |
          set -e
          branch=${{ needs.cutoff-preconditions.outputs.branch }}
          git checkout -b "$branch"
          git push origin $branch

  # Make sure main contains the next minor after cutoff
  bump-main-pr:
    uses: ./.github/workflows/release-bump-version.yaml
    needs: create-branch
    permissions:
      contents: write
      id-token: write
      packages: write
    secrets: inherit
    with:
      bump-type: minor
      ref: ${{ github.ref }}