promote.yaml

name: Promote to master
on:
  push:
    branches: [develop]

# Allow only 1 promotion to occur at any given time, to prevent the possibility
# of multiple changes running at the same time and going in out-of-order.
concurrency:
  group: promote-master
  cancel-in-progress: true

jobs:
  verify:
    name: Verify build integrity
    uses: ./.github/workflows/build.yaml
    permissions:
      contents: read
      security-events: write
      actions: read

  promote:
    name: Promote to Master
    runs-on: ubuntu-latest
    environment: master
    if: success()
    needs:
      - verify
    steps:
      - name: Intentionally fail
        run: |
          echo "::error file=README.md,line=1::This looks weird, right?"
          exit 1

      - name: Checkout develop
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.WORKFLOW_GIT_ACCESS_TOKEN }}
          fetch-depth: 0

      - name: Push
        id: update-branch
        run: |
          echo "new_sha1=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"

          git fetch origin master
          git checkout master
          echo "old_sha1=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"

          git reset --hard develop
          git push origin master


      - name: Summarize Success
        if: success()
        run: |
          sha1=$(git rev-parse --short HEAD)
          echo '# ⏩ Accepted changes from `develop` into `master`'  >> "${GITHUB_STEP_SUMMARY}"
          echo ''                                                   >> "${GITHUB_STEP_SUMMARY}"
          echo '${{github.sha}} is the new HEAD of `master`'        >> "${GITHUB_STEP_SUMMARY}"
          echo ''                                                   >> "${GITHUB_STEP_SUMMARY}"
          echo '## Summary'                                         >> "${GITHUB_STEP_SUMMARY}"
          echo ''                                                   >> "${GITHUB_STEP_SUMMARY}"
          echo 'Below are commits being promoted'                   >> "${GITHUB_STEP_SUMMARY}"
          echo ''                                                   >> "${GITHUB_STEP_SUMMARY}"

          old_sha1=${{steps.update-branch.outputs.old_sha1}}
          new_sha1=${{steps.update-branch.outputs.new_sha1}}
          url_base=https://github.com/${{github.repository}}/commit/
          echo "| SHA1 | Message |" >> "${GITHUB_STEP_SUMMARY}"
          echo "|------|---------|" >> "${GITHUB_STEP_SUMMARY}"
          git log                                                              \
            --pretty='format:| [`%h`](https://github.com/${{github.repository}}/commit/%h) | %s |' \
            --no-show-signature                                                \
            ${old_sha1}..${new_sha1} >> "${GITHUB_STEP_SUMMARY}"

      - name: Summarize Failure
        if: failure()
        run: |
          sha1=$(git rev-parse --short HEAD)
          echo '# 🛑 Rejected changes from `develop` into `master`'           >> "${GITHUB_STEP_SUMMARY}"
          echo ''                                                            >> "${GITHUB_STEP_SUMMARY}"
          echo 'A failure occurred, and `master` was not able to be updated' >> "${GITHUB_STEP_SUMMARY}"