cozystack/.github/workflows/auto-release.yaml

name: Auto Patch Release

on:
  schedule:
    # Run daily at 2:00 AM CET (1:00 UTC in winter, 0:00 UTC in summer)
    # Using 1:00 UTC to approximate 2:00 AM CET
    - cron: '0 1 * * *'
  workflow_dispatch: # Allow manual trigger

concurrency:
  group: auto-release-${{ github.workflow }}
  cancel-in-progress: false

# Top-level token defaults to read-only; jobs request the minimum extra scopes.
permissions:
  contents: read

jobs:
  auto-release:
    name: Auto Patch Release
    runs-on: [self-hosted]
    permissions:
      contents: write
      pull-requests: read

    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
        with:
          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
          owner: cozystack

      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Configure git
        env:
          APP_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          git config user.name  "cozystack-ci[bot]"
          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
          git config --unset-all http.https://github.com/.extraheader || true

      - name: Process release branches
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        env:
          APP_TOKEN: ${{ steps.app-token.outputs.token }}
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const { execSync } = require('child_process');

            // Configure git to use GitHub App token for authentication
            execSync('git config user.name "cozystack-ci[bot]"', { encoding: 'utf8' });
            execSync('git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"', { encoding: 'utf8' });
            execSync(`git remote set-url origin https://x-access-token:${process.env.APP_TOKEN}@github.com/${process.env.GITHUB_REPOSITORY}`, { encoding: 'utf8' });
            // Remove GITHUB_TOKEN extraheader to ensure App token is used (needed to trigger other workflows)
            execSync('git config --unset-all http.https://github.com/.extraheader || true', { encoding: 'utf8' });

            // Get all release-X.Y branches
            const allBranches = execSync('git branch -r | grep -E "origin/release-[0-9]+\\.[0-9]+$" | sed "s|origin/||" | tr -d " "', { encoding: 'utf8' })
              .split('\n')
              .filter(b => b.trim())
              .filter(b => /^release-\d+\.\d+$/.test(b));

            // Only auto-patch-release the N newest minor lines. Older lines are
            // EOL: we don't want stray patch tags (and broken release PRs) cut
            // on them. The window slides automatically as new release-X.Y
            // branches are created — once release-1.5 exists the window becomes
            // {1.5, 1.4} and the trailing line retires on its own.
            const SUPPORTED_LINE_COUNT = 2;
            const lineNum = b => {
              const [maj, min] = b.replace('release-', '').split('.').map(Number);
              return maj * 1000 + min;
            };
            const branches = [...allBranches]
              .sort((a, b) => lineNum(b) - lineNum(a))
              .slice(0, SUPPORTED_LINE_COUNT);

            const skipped = allBranches.filter(b => !branches.includes(b)).sort((a, b) => lineNum(a) - lineNum(b));
            console.log(`Found ${allBranches.length} release branches; auto-releasing the ${SUPPORTED_LINE_COUNT} newest: ${branches.join(', ')}`);
            if (skipped.length) {
              console.log(`Skipping ${skipped.length} EOL release branches: ${skipped.join(', ')}`);
            }
            
            // Get all published releases (not draft)
            const allReleases = await github.rest.repos.listReleases({
              owner: context.repo.owner,
              repo: context.repo.repo,
              per_page: 100
            });
            
            // Filter to only published releases (not draft) with tags matching vX.Y.Z (no suffixes)
            const publishedReleases = allReleases.data
              .filter(r => !r.draft)
              .filter(r => /^v\d+\.\d+\.\d+$/.test(r.tag_name));
            
            console.log(`Found ${publishedReleases.length} published releases without suffixes`);
            
            for (const branch of branches) {
              console.log(`\n=== Processing branch: ${branch} ===`);
              
              // Extract X.Y from branch name (release-X.Y)
              const match = branch.match(/^release-(\d+\.\d+)$/);
              if (!match) {
                console.log(`  ⚠️  Branch ${branch} doesn't match pattern, skipping`);
                continue;
              }
              
              const [major, minor] = match[1].split('.');
              const versionPrefix = `v${major}.${minor}.`;
              
              console.log(`  Looking for releases with prefix: ${versionPrefix}`);
              
              // Find the latest published release for this branch (vX.Y.Z without suffixes)
              const branchReleases = publishedReleases
                .filter(r => r.tag_name.startsWith(versionPrefix))
                .filter(r => /^v\d+\.\d+\.\d+$/.test(r.tag_name)); // Ensure no suffixes
              
              if (branchReleases.length === 0) {
                console.log(`  ⚠️  No published releases found for ${branch}, skipping`);
                continue;
              }
              
              // Sort by version (descending) to get the latest
              branchReleases.sort((a, b) => {
                const aVersion = a.tag_name.match(/^v(\d+)\.(\d+)\.(\d+)$/);
                const bVersion = b.tag_name.match(/^v(\d+)\.(\d+)\.(\d+)$/);
                if (!aVersion || !bVersion) return 0;
                
                const aNum = parseInt(aVersion[1]) * 10000 + parseInt(aVersion[2]) * 100 + parseInt(aVersion[3]);
                const bNum = parseInt(bVersion[1]) * 10000 + parseInt(bVersion[2]) * 100 + parseInt(bVersion[3]);
                return bNum - aNum;
              });
              
              const latestRelease = branchReleases[0];
              console.log(`  ✅ Latest published release: ${latestRelease.tag_name}`);
              
              // Get the commit SHA for this release tag
              let releaseCommitSha;
              try {
                releaseCommitSha = execSync(`git rev-list -n 1 ${latestRelease.tag_name}`, { encoding: 'utf8' }).trim();
                console.log(`  Release commit SHA: ${releaseCommitSha}`);
              } catch (error) {
                console.log(`  ⚠️  Could not find commit for tag ${latestRelease.tag_name}, skipping`);
                continue;
              }
              
              // Checkout the branch
              execSync(`git fetch origin ${branch}:${branch}`, { encoding: 'utf8' });
              execSync(`git checkout ${branch}`, { encoding: 'utf8' });
              
              // Get the latest commit on the branch
              const latestBranchCommit = execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();
              console.log(`  Latest branch commit: ${latestBranchCommit}`);
              
              // Check if there are new commits after the release
              const commitsAfterRelease = execSync(
                `git rev-list ${releaseCommitSha}..HEAD --oneline`,
                { encoding: 'utf8' }
              ).trim();
              
              if (!commitsAfterRelease) {
                console.log(`  ℹ️  No new commits after ${latestRelease.tag_name}, skipping`);
                continue;
              }
              
              console.log(`  ✅ Found new commits after release:`);
              console.log(commitsAfterRelease);
              
              // Calculate next version (Z+1)
              const versionMatch = latestRelease.tag_name.match(/^v(\d+)\.(\d+)\.(\d+)$/);
              if (!versionMatch) {
                console.log(`  ❌ Could not parse version from ${latestRelease.tag_name}, skipping`);
                continue;
              }
              
              const nextPatch = parseInt(versionMatch[3]) + 1;
              const nextTag = `v${versionMatch[1]}.${versionMatch[2]}.${nextPatch}`;
              
              console.log(`  🏷️  Creating new tag: ${nextTag} on commit ${latestBranchCommit}`);
              
              // Create and push the tag with base_ref for workflow triggering
              try {
                // Delete local tag if exists to force update
                try {
                  execSync(`git tag -d ${nextTag}`, { encoding: 'utf8' });
                } catch (e) {
                  // Tag doesn't exist locally, that's fine
                }

                // Delete remote tag if exists
                try {
                  execSync(`git push origin :refs/tags/${nextTag}`, { encoding: 'utf8' });
                } catch (e) {
                  // Tag doesn't exist remotely, that's fine
                }

                // Create tag locally
                execSync(`git tag ${nextTag} ${latestBranchCommit}`, { encoding: 'utf8' });

                // Push tag with HEAD reference to preserve base_ref
                execSync(`git push origin HEAD:refs/tags/${nextTag}`, { encoding: 'utf8' });
                console.log(`  ✅ Successfully created and pushed tag ${nextTag}`);
              } catch (error) {
                console.log(`  ❌ Error creating/pushing tag ${nextTag}: ${error.message}`);
                core.setFailed(`Failed to create tag ${nextTag} for branch ${branch}`);
              }
            }
            
            console.log(`\n✅ Finished processing all release branches`);