reusable-renovate-automerge.yml

# Centralised Renovate auto-merge logic for projectbluefin image repos.
# Each image repo keeps its own workflow_run trigger (which must reference
# the repo-specific CI workflow name) but delegates the PR lookup + merge
# logic here to avoid duplication.
#
# Usage in the caller workflow:
#
#   on:
#     workflow_run:
#       workflows: ["<repo-specific CI workflow name>"]
#       types: [completed]
#
#   permissions:
#     contents: write
#     pull-requests: write
#
#   jobs:
#     automerge:
#       if: github.event.workflow_run.conclusion == 'success'
#       uses: projectbluefin/actions/.github/workflows/reusable-renovate-automerge.yml@v1
#       with:
#         head_sha: ${{ github.event.workflow_run.head_sha }}
#       # Optional — only needed when the base branch review-bypass rules
#       # exclude github-actions[bot] and require the MergeRaptor app identity.
#       # REQUIRED when base_branch uses a merge queue: merge-queue groups
#       # created by github-actions[bot] never dispatch required checks
#       # (GITHUB_TOKEN events do not trigger workflows), so the queue entry
#       # wedges at AWAITING_CHECKS until it times out. Pass GitHub App
#       # credentials so the merge is performed by the app instead:
#       # secrets:
#       #   app_id: ${{ secrets.MERGERAPTOR_APP_ID }}
#       #   private_key: ${{ secrets.MERGERAPTOR_PRIVATE_KEY }}
#       # Or pass a stored token directly:
#       # secrets:
#       #   token: ${{ secrets.MERGE_TOKEN }}

name: Reusable Renovate Auto-merge

on:
  workflow_call:
    inputs:
      head_sha:
        description: "Head SHA of the completed workflow run"
        type: string
        required: true
      base_branch:
        description: "Base branch to search for Renovate PRs targeting"
        type: string
        default: "testing"
        required: false
    secrets:
      app_id:
        description: >
          Optional GitHub App ID used to mint the merge token for protected
          branches that exclude github-actions[bot] from review bypass. Also
          required for merge-queue base branches, where github-actions[bot]
          queue groups never dispatch required checks.
        required: false
      private_key:
        description: >
          Optional GitHub App private key used with app_id to mint the merge
          token for protected branches.
        required: false
      token:
        description: >
          Optional GitHub token with merge permissions. Falls back to
          github.token when no app token or explicit token is provided.
        required: false

permissions:
  contents: write
  pull-requests: write

jobs:
  automerge:
    name: Auto-merge Renovate PRs
    runs-on: ubuntu-latest
    env:
      APP_ID: ${{ secrets.app_id }}
      PRIVATE_KEY: ${{ secrets.private_key }}
    steps:
      - name: Generate MergeRaptor token
        if: ${{ env.APP_ID != '' && env.PRIVATE_KEY != '' }}
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          app-id: ${{ env.APP_ID }}
          private-key: ${{ env.PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      - name: Find qualifying Renovate PR for this commit
        id: find-pr
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.token || github.token }}
          HEAD_SHA: ${{ inputs.head_sha }}
          BASE_BRANCH: ${{ inputs.base_branch }}
        run: |
          PR_NUMBER=$(gh api graphql -f query="
            query(\$owner: String!, \$repo: String!, \$base: String!) {
              repository(owner: \$owner, name: \$repo) {
                pullRequests(first: 100, states: OPEN, baseRefName: \$base) {
                  nodes {
                    number
                    headRefOid
                    author { login }
                    autoMergeRequest {
                      enabledAt
                      enabledBy { login }
                    }
                  }
                }
              }
            }" \
            -f owner="${GITHUB_REPOSITORY_OWNER}" \
            -f repo="${GITHUB_REPOSITORY#*/}" \
            -f base="$BASE_BRANCH" \
            | jq -r --arg head "$HEAD_SHA" '.data.repository.pullRequests.nodes[]
              | select(.headRefOid == $head)
              | select(.author.login == "app/mergeraptor" or .author.login == "renovate[bot]")
              | select(.autoMergeRequest != null)
              | select(.autoMergeRequest.enabledBy != null)
              | select(.autoMergeRequest.enabledBy.login == "app/mergeraptor" or .autoMergeRequest.enabledBy.login == "renovate[bot]")
              | .number' | head -1)

          if [ -z "$PR_NUMBER" ]; then
            echo "No eligible Renovate/Mergeraptor PR found for SHA $HEAD_SHA on base $BASE_BRANCH — skipping"
            echo "pr_number=" >> "$GITHUB_OUTPUT"
          else
            echo "Found eligible Renovate/Mergeraptor PR #$PR_NUMBER"
            echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
          fi

      - name: Merge PR
        if: steps.find-pr.outputs.pr_number != ''
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.token || github.token }}
          PR_NUMBER: ${{ steps.find-pr.outputs.pr_number }}
        run: |
          set +e
          CHECKS=$(gh pr checks "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json bucket,name)
          CHECKS_STATUS=$?
          set -e

          if [ "$CHECKS_STATUS" -ne 0 ] && [ "$CHECKS_STATUS" -ne 1 ] && [ "$CHECKS_STATUS" -ne 8 ]; then
            exit "$CHECKS_STATUS"
          fi

          if [ -z "$CHECKS" ] || ! jq -e 'type == "array"' >/dev/null 2>&1 <<<"$CHECKS"; then
            echo "Failed to read PR check rollup for PR #$PR_NUMBER" >&2
            exit 1
          fi

          if [ "$(jq 'length' <<<"$CHECKS")" -eq 0 ] ||
             [ "$(jq '[.[] | select(.bucket != "pass")] | length' <<<"$CHECKS")" -ne 0 ]; then
            echo "PR #$PR_NUMBER does not have a complete successful check rollup; skipping"
            exit 0
          fi

          # Direct squash-merge is intentional: the MergeRaptor installation
          # token can use the protected-branch review bypass, while queue/auto
          # merge cannot rely on that app-only exception. On a merge-queue
          # branch this call enqueues instead of merging directly; the queue
          # entry's actor is this step's token identity, and github-actions[bot]
          # entries never dispatch required checks — pass app_id/private_key in
          # that case.
          gh pr merge "$PR_NUMBER" --squash --repo "$GITHUB_REPOSITORY"
          echo "Merged PR #$PR_NUMBER"