releasepr.yml

name: Create Release PR

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  createPR:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          # Read-only checkout: the default token is never persisted into the git
          # config. The write-capable app token is only introduced at the push
          # step below.
          persist-credentials: false

      - name: Get package info
        shell: bash
        id: package-info
        run: echo "version=$(python scripts/get_package_version.py)" >> $GITHUB_OUTPUT

      - name: 'Find pre-release with tag v${{ steps.package-info.outputs.version}}'
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        id: pre-release-exists
        env:
          APP_VERSION: ${{ steps.package-info.outputs.version}}
        with:
          script: |
            const releases = await github.rest.repos.listReleases({
              owner: context.repo.owner,
              repo: context.repo.repo
            })
            const tagName = `v${process.env.APP_VERSION}`
            const releaseWithTag = releases.data.find(release => release.tag_name === tagName && (release.draft || release.prerelease))
            return releaseWithTag ? 'true' : 'false'
          result-encoding: string

      - name: Create release pull request
        if: steps.pre-release-exists.outputs.result == 'true'
        env:
          APP_VERSION: ${{ steps.package-info.outputs.version }}
          GH_TOKEN: ${{ secrets.JLAB_APP_TOKEN }}
        run: |
          set -eux
          # git checkout -b fails if the branch already exists, which keeps a
          # re-run from opening a duplicate release PR.
          BRANCH_NAME="release-v${APP_VERSION}"
          git checkout -b "${BRANCH_NAME}"
          git config user.name "JupyterLab Desktop Bot"
          git config user.email 'jupyterlab-bot@users.noreply.github.com'

          date +%s > auto-release.log
          git add auto-release.log
          git commit -m "Update auto-release logs"
          # Checkout ran with persist-credentials: false. Wire the app token in
          # through gh's credential helper just for this push, so it never lands
          # in the git config or the command log; git push then uses GH_TOKEN.
          gh auth setup-git
          git push origin "HEAD:refs/heads/${BRANCH_NAME}"

          gh pr create \
            --head "${BRANCH_NAME}" \
            --base "${GITHUB_REF_NAME}" \
            --title "Release v${APP_VERSION}" \
            --body "Release v${APP_VERSION}"