maintenance-cherry-pick.yml

name: Cherry-pick into target branches

on:
  pull_request:
    types:
      - closed
    branches:
      - main

permissions:
  actions: write
  issues: write

jobs:
  # Check if labels exist before executing the next job.
  # We cannot use `if` because the matrix is evaluated before the `if` statement.
  check_labels:
    runs-on: ubuntu-latest
    if: ${{ join(github.event.pull_request.labels) != '' }}
    steps:
      - run: echo Labels are not empty, continuing

  cherry_pick:
    needs: [check_labels]
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true &&
      github.event.pull_request.user.login != 'renovate[bot]'
    outputs:
      failed_branches: ${{ steps.update_failed_branches.outputs.failed_branches }}
    strategy:
      matrix:
        label: ${{ github.event.pull_request.labels.*.name }}

    steps:
      - name: Get token
        id: get_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.MAINTENANCE_APP_ID }}
          private_key: ${{ secrets.MAINTENANCE_APP_PEM }}
      - name: Get branch name from label
        id: branch_name
        run: |
          echo "branch=$(echo ${{ matrix.label }} | sed -n 's/target: \([0-9]*.x\).*/\1/p')" >> $GITHUB_OUTPUT

      - uses: actions/checkout@v4
        if: steps.branch_name.outputs.branch
        with:
          token: ${{ steps.get_token.outputs.token }}
          fetch-depth: 0

      - name: Cherry-pick changes into ${{ steps.branch_name.outputs.branch }}
        if: steps.branch_name.outputs.branch
        run: |
          git checkout ${{ steps.branch_name.outputs.branch }}
          git -c user.name="github-actions" -c user.email="github-actions@github.com" cherry-pick ${{ github.sha }}
          git push

      - name: Update failed branches
        if: ${{ failure() }}
        id: update_failed_branches
        run: |
          echo "failed_branches=$(echo ${{ steps.branch_name.outputs.branch }} ${{ steps.update_failed_branches.outputs.failed_branches}})" >> $GITHUB_OUTPUT

  update_maintenance_issue:
    runs-on: ubuntu-latest
    needs: cherry_pick
    if: always() && needs.cherry_pick.result == 'failure' &&
      github.event.pull_request.user.login != 'renovate[bot]'

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        if: needs.cherry_pick.outputs.failed_branches
        with:
          node-version-file: .nvmrc

      - run: yarn install --frozen-lockfile --non-interactive
        if: needs.cherry_pick.outputs.failed_branches

      - name: Update maintenance issue
        if: needs.cherry_pick.outputs.failed_branches
        run: yarn ts-hooks scripts/update-maintenance-issue.ts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.number }}
          FAILED_BRANCHES: ${{ needs.cherry_pick.outputs.failed_branches }}