matrix-authentication-service/.github/workflows/release-branch.yaml

# Copyright 2025 New Vector Ltd.
#
# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
# Please see LICENSE files in the repository root for full details.

name: Create a new release branch
on:
  workflow_dispatch:
    inputs:
      kind:
        description: Kind of release (major = v1.2.3 -> v2.0.0-rc.0, minor = v1.2.3 -> v1.3.0-rc.0)
        required: true
        type: choice
        default: minor
        options:
          - major
          - minor

jobs:
  compute-version:
    name: Compute the next ${{ inputs.kind }} RC version
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    outputs:
      full: ${{ steps.next.outputs.full }}
      short: ${{ steps.next.outputs.short }}

    steps:
      - name: Fail the workflow if this is not the main branch
        if: ${{ github.ref_name != 'main' }}
        run: exit 1

      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        # Only the minimal profile is required here to run `cargo metadata`
        run: rustup toolchain install stable --profile minimal

      - name: Install pnpm
        uses: pnpm/action-setup@v6.0.9

      - name: Install Node
        uses: actions/setup-node@v7.0.0
        with:
          node-version-file: .node-version
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Compute the new minor RC
        id: next
        env:
          BUMP: pre${{ inputs.kind }}
        run: |
          CURRENT_VERSION="$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[] | select(.name == "mas-cli") | .version')"
          NEXT_VERSION="$(pnpm exec semver -i "$BUMP" --preid rc "${CURRENT_VERSION}")"
          # compute the short minor version, e.g. 0.1.0-rc.1 -> 0.1
          SHORT_VERSION="$(echo "${NEXT_VERSION}" | cut -d. -f1-2)"
          echo "full=${NEXT_VERSION}" >> "$GITHUB_OUTPUT"
          echo "short=${SHORT_VERSION}" >> "$GITHUB_OUTPUT"

  localazy:
    name: Create a new branch in Localazy
    runs-on: ubuntu-24.04
    needs: [compute-version]

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Install pnpm
        uses: pnpm/action-setup@v6.0.9

      - name: Install Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .node-version
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Create a new branch in Localazy
        run: pnpm exec localazy branch -w "$LOCALAZY_WRITE_KEY" create main "$BRANCH"
        env:
          LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
          # Localazy doesn't like slashes in branch names, so we just use the short version
          # For example, a 0.13.0 release will create a localazy branch named "v0.13" and a git branch named "release/v0.13"
          BRANCH: v${{ needs.compute-version.outputs.short }}

  tag:
    uses: ./.github/workflows/tag.yaml
    needs: [compute-version]
    with:
      version: ${{ needs.compute-version.outputs.full }}
    secrets:
      BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}

  merge-back:
    uses: ./.github/workflows/merge-back.yaml
    needs: [tag]
    with:
      sha: ${{ needs.tag.outputs.sha }}
    secrets:
      BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}

  branch:
    name: Create a new release branch
    runs-on: ubuntu-24.04

    permissions:
      contents: write
      pull-requests: write

    needs: [tag, compute-version, localazy]
    steps:
      - name: Checkout the code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          sparse-checkout: |
            .github/scripts
          persist-credentials: false

      - name: Create a new release branch
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          BRANCH: release/v${{ needs.compute-version.outputs.short }}
          SHA: ${{ needs.tag.outputs.sha }}
        with:
          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
          script: |
            const script = require('./.github/scripts/create-release-branch.cjs');
            await script({ core, github, context });