publish.yml

---
name: brew pr-pull
permissions: {}

on:
  pull_request_target:
    types:
      - labeled

jobs:
  pr-pull:
    if: |
      github.event.label.name == 'pr-pull' &&
      github.event.pull_request.state == 'open' &&
      !contains(github.event.pull_request.labels.*.name, 'bottle-published')
    runs-on: ubuntu-24.04
    permissions:
      actions: read
      checks: read
      contents: write
      issues: read
      packages: write
      pull-requests: write
    steps:
      - name: Comment on PR
        uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59  # v3.12
        with:
          repo-token: ${{ secrets.GH_BOT_TOKEN }}
          message: >
            ⚠️ **Important**: This PR is being processed to add bottles.

            Please **do not push any changes** to this PR branch as it may cause conflicts or issues with the
            bottle publishing process.

            If you need to make changes:
            1. Mark this PR as draft

            2. Wait for the
            [publish workflow](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
            to complete

            3. Make your changes after the bottles have been added

      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@main
        with:
          stable: false

      # Homebrew's Linux sandbox requires bwrap on PATH before brew pr-pull runs brew doctor.
      # The sysctls enable the rootless user namespaces that bwrap needs to create the sandbox.
      - name: Set up Homebrew Linux sandbox
        if: runner.os == 'Linux'
        run: |
          brew install bubblewrap
          sudo sysctl -w kernel.unprivileged_userns_clone=1
          sudo sysctl -w user.max_user_namespaces=28633
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true

      - name: Set up git
        uses: Homebrew/actions/git-user-config@main
        with:
          username: ${{ vars.GH_BOT_NAME }}

      - name: Get PR data
        id: pr-data
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const pr = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.payload.pull_request.number
            });

            const data = pr.data;
            const branch = data.head.ref;
            const remoteBranch = branch;
            const remote = data.head.repo.clone_url;
            const headRepoOwner = data.head.repo.owner.login;
            const isFork = data.head.repo.fork;

            const finalBranch = isFork ? `${headRepoOwner}-${branch}` : branch;

            core.setOutput('branch', finalBranch);
            core.setOutput('remote_branch', remoteBranch);
            core.setOutput('remote', remote);

      - name: Checkout PR branch
        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
        env:
          BRANCH: ${{ steps.pr-data.outputs.branch }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PULL_REQUEST: ${{ github.event.pull_request.number }}
        run: gh pr checkout "${PULL_REQUEST}" --branch "${BRANCH}" --repo "${GITHUB_REPOSITORY}"

      - name: Pull bottles
        env:
          HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_GITHUB_PACKAGES_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_GITHUB_PACKAGES_USER: ${{ github.repository_owner }}
          PULL_REQUEST: ${{ github.event.pull_request.number }}
        run: |
          for attempt in 1 2; do
            brew pr-pull \
              --branch-okay \
              --committer="${{ vars.GH_BOT_NAME }} <${{ secrets.GH_BOT_EMAIL }}>" \
              --debug \
              --no-cherry-pick \
              --tap="${GITHUB_REPOSITORY}" \
              "${PULL_REQUEST}" && break
            if [ "${attempt}" -lt 2 ]; then
              echo "brew pr-pull failed, retrying in 30 seconds..."
              sleep 30
            fi
          done

      - name: Push commits
        uses: Homebrew/actions/git-try-push@main
        with:
          token: ${{ secrets.GH_BOT_TOKEN }}
          directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
          remote: ${{ steps.pr-data.outputs.remote }}
          branch: ${{ steps.pr-data.outputs.branch }}
          remote_branch: ${{ steps.pr-data.outputs.remote_branch }}
        env:
          GIT_COMMITTER_NAME: ${{ vars.GH_BOT_NAME }}
          GIT_COMMITTER_EMAIL: ${{ secrets.GH_BOT_EMAIL }}

      - name: Add bottle-published label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.pull_request.number,
              labels: ['bottle-published']
            });

      - name: Comment on PR
        uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59  # v3.12
        with:
          repo-token: ${{ secrets.GH_BOT_TOKEN }}
          message: Bottles have been added to this PR.