chore(release): create remote branches via API (#2816)

* ci(release): create release branch on remote via API

- Add GH_TOKEN to Create release branch step for gh api
- Create remote branch with POST to git/refs before later steps
- Ensures branch exists for signed-commit action

Made-with: Cursor

* ci(release): create hotfix remote branch via gh api in script

- Move remote branch creation from workflow into create-hotfix-branch.sh
- Script uses gh api (POST/PATCH refs) with GH_TOKEN and REPO env
- Workflow passes GH_TOKEN and REPO; remove duplicate API step

Made-with: Cursor

* ci(release): reset to ORIG_HEAD, drop early remote ref create

- Use git reset --hard ORIG_HEAD so release branch is from source (e.g. develop) only
- Remove create-remote-ref step from Create release branch; rely on Create release branch on remote

Made-with: Cursor

* chore: remove redundant change

* chore: use github app token

* chore: Update scripts/create-hotfix-branch.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: saikumarrs

.github/workflows/create-hotfix-branch.yml

@@ -21,25 +21,32 @@ jobs:
     name: Create a new hotfix branch
     runs-on: [self-hosted, Linux, X64]
     needs: validate-actor
+    permissions:
+      contents: write # to create branch ref via API
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
         with:
           egress-policy: audit
 
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_PRIVATE_KEY }}
+          permission-contents: write # to create branch ref via API
+
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-
-      # In order to make a commit, we need to initialize a user.
-      # You may choose to write something less generic here if you want, it doesn't matter functionality wise.
-      - name: Initialize mandatory git config
-        run: |
-          git config user.name "GitHub actions"
-          git config user.email noreply@github.com
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Create hotfix branch
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          REPO: ${{ github.repository }}
         run: |
           chmod +x scripts/create-hotfix-branch.sh
           ./scripts/create-hotfix-branch.sh "${{ github.event.inputs.hotfix_branch_name }}"

.github/workflows/draft-new-release.yml

@@ -94,7 +94,7 @@ jobs:
 
           npm run bump-version:monorepo
           new_version=$(jq -r .version package.json)
-          git reset --hard
+          git reset --hard ORIG_HEAD
 
           branch_name="${release_type}/${new_version}-${{ github.event.inputs.release_ticket_id }}"
 

scripts/create-hotfix-branch.sh

@@ -38,28 +38,49 @@ if [ ${#FULL_BRANCH_NAME} -gt 255 ]; then
     error "Full branch name ($FULL_BRANCH_NAME) is too long (maximum 255 characters)"
 fi
 
-# Check if branch already exists
+# Check if branch already exists locally
 if git show-ref --verify --quiet refs/heads/$FULL_BRANCH_NAME; then
-    error "Branch ($FULL_BRANCH_NAME) already exists"
+    error "Branch ($FULL_BRANCH_NAME) already exists locally"
 fi
 
-# Create the branch
+# Create the branch locally
 git checkout -b $FULL_BRANCH_NAME
 
-# Push the branch and handle potential errors
-if ! git push origin $FULL_BRANCH_NAME; then
-    error "Failed to push branch ($FULL_BRANCH_NAME) to remote. Please check your permissions and try again."
+# Ensure required environment variables for GitHub API are present
+if [ -z "$GH_TOKEN" ]; then
+    error "GH_TOKEN environment variable is required to create remote branch via GitHub API"
 fi
 
-# Verify the branch exists remotely
-if ! git ls-remote --heads origin $FULL_BRANCH_NAME | grep -q $FULL_BRANCH_NAME; then
-    error "Branch ($FULL_BRANCH_NAME) was not pushed to remote successfully"
+# Determine repository slug (owner/repo)
+REPO_SLUG="${REPO:-$GITHUB_REPOSITORY}"
+if [ -z "$REPO_SLUG" ]; then
+    # Fallback to parsing from git remote if not provided
+    REMOTE_URL=$(git config --get remote.origin.url)
+    REMOTE_URL=${REMOTE_URL#git@github.com:}
+    REMOTE_URL=${REMOTE_URL#https://github.com/}
+    REPO_SLUG=${REMOTE_URL%.git}
 fi
 
-# Get the repository URL
-REPO_URL=$(git config --get remote.origin.url)
-REPO_URL=${REPO_URL#git@github.com:}
-REPO_URL=${REPO_URL%.git}
+if [ -z "$REPO_SLUG" ]; then
+    error "Unable to determine repository slug for GitHub API"
+fi
+
+# Create or update the remote branch ref via GitHub API before any future commits
+sha=$(git rev-parse HEAD)
+if gh api "repos/${REPO_SLUG}/git/ref/heads/${FULL_BRANCH_NAME}" >/dev/null 2>&1; then
+    gh api "repos/${REPO_SLUG}/git/refs/heads/${FULL_BRANCH_NAME}" \
+      --method PATCH \
+      -f "sha=${sha}" \
+      -F "force=true"
+else
+    gh api "repos/${REPO_SLUG}/git/refs" \
+      --method POST \
+      -f "ref=refs/heads/${FULL_BRANCH_NAME}" \
+      -f "sha=${sha}"
+fi
+
+# Get the repository URL for success message
+REPO_URL="https://github.com/$REPO_SLUG"
 
-success "Successfully created hotfix branch!"
-echo "Branch URL: https://github.com/$REPO_URL/tree/$FULL_BRANCH_NAME" 
+success "Successfully created hotfix branch locally and ensured remote branch via GitHub API."
+echo "Branch URL: $REPO_URL/tree/$FULL_BRANCH_NAME"