From 060c79d5c4f6f27068ebf6d411ad999b7454de3a Mon Sep 17 00:00:00 2001
From: renner <renner0@posteo.de>
Date: Wed, 22 Jul 2026 21:22:51 +0200
Subject: [PATCH] chore(ci): stop hardcoding stable-branch

Instead we can define an environment variable for github actions.

For things where we can't, globs/regex is probably good enough.

When we branch/stabilize "stable-f45" then we will delete the old one
anyway, so we shouldn't be in a situation where we'll get spammed with
like 3 PRs.

The only remaining things where it's hardcoded is the pull config and
docs.
---
 .github/renovate.json5                              | 4 ++--
 .github/workflows/build-image-latest-main.yml       | 6 +++---
 .github/workflows/build-image-stable.yml            | 2 +-
 .github/workflows/cherry-pick-to-stable.yml         | 2 +-
 .github/workflows/generate-release.yml              | 2 +-
 .github/workflows/trigger-schedule-stable-image.yml | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index ed9085640..bc663d626 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -4,7 +4,7 @@
     "config:best-practices"
   ],
 
-  "baseBranchPatterns": ["main", "stable-f44"],
+  "baseBranchPatterns": ["main", "/^stable-f[0-9][0-9]$/"],
 
   // Do not rebase when the default branch is updated
   "rebaseWhen": "never",
@@ -59,7 +59,7 @@
       ],
       // Brew and common are not "security updates", they have to go through :testing/main first
       // to reach a stable release
-      "matchBaseBranches": ["stable-f44"],
+      "matchBaseBranches": ["/^stable-f[0-9][0-9]$/"],
       "enabled": false
     },
     {
diff --git a/.github/workflows/build-image-latest-main.yml b/.github/workflows/build-image-latest-main.yml
index c94bed5ea..636072b43 100644
--- a/.github/workflows/build-image-latest-main.yml
+++ b/.github/workflows/build-image-latest-main.yml
@@ -2,17 +2,17 @@ name: Latest Images
 on:
   push:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"
       - ".github/workflows/scorecard.yml"
   merge_group:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
   pull_request:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"
diff --git a/.github/workflows/build-image-stable.yml b/.github/workflows/build-image-stable.yml
index 4c05b95bb..f130419f9 100644
--- a/.github/workflows/build-image-stable.yml
+++ b/.github/workflows/build-image-stable.yml
@@ -6,7 +6,7 @@ on:
   # We still want to know if things are broken
   pull_request:
     branches:
-      - stable-f44
+      - 'stable-f[0-9][0-9]'
     paths-ignore:
       - "**.md"
       - ".github/workflows/moderator.yml"
diff --git a/.github/workflows/cherry-pick-to-stable.yml b/.github/workflows/cherry-pick-to-stable.yml
index f277813d0..833435af4 100644
--- a/.github/workflows/cherry-pick-to-stable.yml
+++ b/.github/workflows/cherry-pick-to-stable.yml
@@ -46,7 +46,7 @@ jobs:
         with:
           # Use the dynamically generated GitHub App token here too
           github_token: ${{ steps.generate-token.outputs.token }}
-          target_branches: "stable-f44"
+          target_branches: ${{ vars.STABLE_BRANCH }}
           add_labels: "backported-to-stable"
           pull_title: '${pull_title} [Backport ${target_branch}]'
           pull_description: |
diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml
index d29c67b83..492f2f180 100644
--- a/.github/workflows/generate-release.yml
+++ b/.github/workflows/generate-release.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 500
-          ref: stable-f44
+          ref: ${{ vars.STABLE_BRANCH }}
 
       - name: Install Just
         run: |
diff --git a/.github/workflows/trigger-schedule-stable-image.yml b/.github/workflows/trigger-schedule-stable-image.yml
index ffc2533f8..f5aebe5bb 100644
--- a/.github/workflows/trigger-schedule-stable-image.yml
+++ b/.github/workflows/trigger-schedule-stable-image.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Trigger Stable Image Build
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BRANCH: stable-f44
+          BRANCH: ${{ vars.STABLE_BRANCH }}
         run: |
           gh workflow run \
             build-image-stable.yml \