Create/delete release branches automatically (#1488)

* Create/delete release branches automatically

* Update gha: cleanup old releases

* Fix path

* Remove version from local workflow path

* Adjust comments

* Fix missing permission

* Address comments

* comments

* Fix env

Author: hebelsan

.github/workflows/build.yaml

@@ -28,7 +28,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.25'
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: gardener/cc-utils/.github/actions/setup-git-identity@master
         with:
           remove-trusted-label: false

.github/workflows/create-branch.yaml

@@ -0,0 +1,57 @@
+name: Reusable - Create Branch
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+    secrets:
+      token:
+        required: true
+
+jobs:
+  create-branch:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+
+      - name: Setup Git identity # Configure git with a user name and email
+        uses: gardener/cc-utils/.github/actions/setup-git-identity@master
+
+      - name: Create new branch
+        run: |
+          # Validate input
+          if [ -z "${{ inputs.version }}" ]; then
+            echo "ERROR: version input is empty"
+            exit 1
+          fi
+          
+          VERSION="${{ inputs.version }}"
+          # Remove last .X (patch) from the version
+          MINOR_VERSION="${VERSION%.*}"
+          BRANCH_NAME="release-${MINOR_VERSION}"
+          
+          # Abort if branch already exists
+          if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then
+            echo "Branch ${BRANCH_NAME} already exists on origin. Exiting."
+            exit 0
+          fi
+          git checkout -b "${BRANCH_NAME}"
+          
+          # Compute next development version
+          NEXT_VERSION="${MINOR_VERSION}.1"
+          echo "${NEXT_VERSION}-dev" > VERSION
+          
+          # Generate artifacts
+          make generate
+          
+          # Commit and push changes
+          git add --all
+          git commit -m "[bot] Prepare next Development Cycle $NEXT_VERSION"
+          git push origin $BRANCH_NAME
+        env:
+          GITHUB_TOKEN: ${{ secrets.token }}

.github/workflows/release-cleanup.yaml

@@ -0,0 +1,61 @@
+name: Cleanup Old Releases
+
+on:
+  schedule:
+    # Runs every Sunday at 12:00 AM UTC
+    - cron: '0 0 * * 0'
+
+  workflow_dispatch: # Optional manual trigger
+
+permissions:
+  contents: write   # This allows deleting branches
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install jq
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      - name: Cleanup old branches
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          #!/bin/bash
+          set -euo pipefail
+
+          # Fetch the latest release tag
+          latest_tag=$(gh release list --exclude-pre-releases --limit 1 | awk '{print $1}')
+
+          if [[ $latest_tag =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Latest release: $latest_tag"
+          else
+            echo "Latest release tag '$latest_tag' is NOT a valid semver (vX.Y.Z)"
+            exit 0
+          fi
+
+          # Parse major and minor
+          IFS='.' read -r major minor patch <<<"${latest_tag#v}"
+          
+          # Check if minor version is smaller than 3
+          if [[ $minor -lt 3 ]]; then
+            echo "Latest minor version ($minor) is smaller than 3. No branches or milestones to delete."
+            exit 0
+          fi
+          
+          cutoff_minor=$((minor - 3))
+          echo "Will delete all release branches <= v$major.$cutoff_minor"
+
+          # List all branches and filter ones that match release-vX.Y
+          for branch in $(gh api repos/$GH_REPO/branches --paginate --jq '.[].name'); do
+            if [[ $branch =~ ^release-v([0-9]+)\.([0-9]+) ]]; then
+              b_major=${BASH_REMATCH[1]}
+              b_minor=${BASH_REMATCH[2]}
+
+              if [[ $b_major -eq $major && $b_minor -le $cutoff_minor ]]; then
+                echo "Deleting old branch: $branch"
+                gh api -X DELETE "repos/$GH_REPO/git/refs/heads/$branch" || true
+              fi
+            fi
+          done

.github/workflows/release-milestone.yaml

@@ -13,7 +13,7 @@ jobs:
     name: Check Release Milestone
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v5
       with:
         path: './'
 

.github/workflows/release.yaml

@@ -59,5 +59,14 @@ jobs:
     with:
       name: ${{ needs.release-to-github-and-bump.outputs.component-descriptor.version }}
       strip_patch: true
-    secrets:
-      token: ${{ secrets.GITHUB_TOKEN }}
+    secrets: inherit
+
+  create-release-branch:
+    if: ${{ inputs.next-version == 'bump-minor' && inputs.release-version == 'set-prerelease' }}
+    needs:
+      - build
+      - release-to-github-and-bump
+    uses: ./.github/workflows/create-branch.yaml
+    with:
+      version: ${{ needs.release-to-github-and-bump.outputs.component-descriptor.version }}
+    secrets: inherit