meta-balena-esr.yml

name: "Creates ESR branch and tag"

# Runs quarterly on the first day to create an ESR branch on the latest patch
# of the last minor version

on:
  # Run at 00:06 the first day every 3rd month (quarterly)
  # Run weekly too to keep the workflow enabled
  schedule:
    - cron: "6 0 1 */3 *"
    - cron: "6 0 * * 1"

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
    inputs:
      esr-version:
        required: false
        type: string
        description: ESR version override, for example 2022.10. By default it uses current year and month.

env:
  # get the user id of the GitHub App
  # gh api /users/balenaos-esr%5Bbot%5D
  GIT_AUTHOR_NAME: balenaos-esr[bot]
  GIT_AUTHOR_EMAIL: 146746583+balenaos-esr[bot]@users.noreply.github.com
  GIT_COMMITTER_NAME: balenaos-esr[bot]
  GIT_COMMITTER_EMAIL: 146746583+balenaos-esr[bot]@users.noreply.github.com

jobs:
  fetch:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10"]
    outputs:
      status: ${{ join(steps.*.conclusion) }}
    steps:
      - name: "Exit on weekly runs"
        if: github.event_name == 'schedule' && github.event.schedule != '6 0 1 */3 *'
        run: exit 1

      - name: Generate GitHub App installation token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        id: gh_app_token
        with:
          app_id: ${{ vars.ESR_BOT_APP_ID || '400859' }}
          installation_retrieval_mode: organization
          installation_retrieval_payload: ${{ github.event.repository.owner.login }}
          private_key: ${{ secrets.ESR_BOT_PRIVATE_KEY }}
          repositories: >
            ["${{ github.event.repository.name }}"]

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          # The default GITHUB_TOKEN does not have workflow scope
          # This is needed to push a new branch with workflow files
          token: ${{ steps.gh_app_token.outputs.token }}
          persist-credentials: true

      - name: "Only run for meta-balena repository"
        id: assert-meta-balena-repository
        run: |
          if [ -f "$(pwd)/repo.yml" ]; then
            if grep -q "yocto layer" repo.yml; then
              exit 0
            fi
          fi
          exit 1

      - name: "Assert ESR version"
        id: assert-esr-version
        run: |
          if [ "${{ inputs.esr-version }}" != "" ]; then
            if ! [[ "${{ inputs.esr-version }}" =~ ^[1-3][0-9]{3}\.[0-1]?[0-9]$ ]]; then
              echo "Invalid ESR version ${{ inputs.esr-version }}"
              exit 1
            fi
            esr_version=${{ inputs.esr-version }}
          else
           # shellcheck disable=SC2001
            esr_version="$(date '+%Y').$(echo "$(date '+%m')" | sed "s/^0*//")"
            if ! [[ "${esr_version}" =~ ^[1-3][0-9]{3}\.[0-1]?[0-9]$ ]]; then
              echo "No scheduled ESR release for ${esr-version}."
              exit 1
            fi
          fi
          echo "ESR version: ${esr_version}"
          echo "esr_version=${esr_version}" >> "$GITHUB_OUTPUT"

      - name: "Calculate versions"
        id: calculate-versions
        run: |
          # The ESR branch starts at the HEAD of the latest minor version
          git fetch --tags origin
          current_os_version=$(git describe --abbrev=0 "$(git rev-list --tags --max-count=1)")
          current_os_version="${current_os_version:1}"
          va=("${current_os_version//./ }")
          if [ ${#va[@]} -ne 3 ]; then
            echo "Invalid current version: ${current_os_version}"
            exit 1
          fi
          if [ "${va[1]}" != 0 ]; then
            ((va[1]--))
            os_version=$(git tag --sort -version:refname | grep "v${va[0]}\.${va[1]}" | head -n1)
          else
            ((va[0]--))
            os_version=$(git tag --sort -version:refname | grep "v${va[0]}\." | head -n1)
          fi
          os_version="${os_version:1}"
          ov_arr=( "${os_version//./ }" )
          os_esr_branch=${ov_arr[0]}.${ov_arr[1]}.x
          if git ls-remote --exit-code --heads origin "${os_esr_branch}" > /dev/null; then
            echo "Branch ${os_esr_branch} already exists"
            exit 1
          fi
          echo "os_version=${os_version}" >> "$GITHUB_OUTPUT"
          echo "os_esr_branch=${os_esr_branch}" >> "$GITHUB_OUTPUT"
          echo "OS version is ${os_version} and branch ${os_esr_branch}"
          exit 0

      - name: Setup Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pyyaml semver

      - name: "Create ESR branch"
        id: meta-balena-esr-branch
        run: |
          os_version=${{ steps.calculate-versions.outputs.os_version }}
          os_esr_branch=${{ steps.calculate-versions.outputs.os_esr_branch }}
          esr_version=${{ steps.assert-esr-version.outputs.esr_version }}
          git checkout -b "${os_esr_branch}" refs/tags/v"${os_version}"
          # Modify repo.yml
          python3 <<-EOF
          import sys
          import yaml
          import semver
          filePath = './repo.yml'
          parsed_os_version = semver.VersionInfo.parse('${os_version}')
          version = str(parsed_os_version.major) + '.' + str(parsed_os_version.minor)
          with open(filePath, 'r') as original:
              ydata = yaml.safe_load(original)
              if 'esr' in ydata:
                  # Nothing to do
                  print("ESR branch already configured")
                  sys.exit(1)
              ydata['esr'] = {'version': version, 'bsp-branch-pattern': '${esr_version}.x'}
          with open(filePath, 'w') as modified:
              yaml.dump(ydata, modified)
          EOF
          git add repo.yml
          git commit -F- <<-EOF
          Declare ESR ${os_esr_branch:0:-2}

          Change-type: none
          EOF
          git push origin refs/heads/${os_esr_branch}
          git tag -a -m "" ${os_esr_branch} ${os_esr_branch}
          git push origin refs/tags/${os_esr_branch}