rebase

.github/workflows/component-release-finish-on-approval.yml

@@ -0,0 +1,120 @@
+name: Component Release Finish On Approval
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-finish-${{ github.event.pull_request.head.ref }}
+  cancel-in-progress: false
+
+jobs:
+  finish-release:
+    name: Finish release when PR is approved
+    if: >
+      github.event.review.state == 'approved' &&
+      github.event.pull_request.base.ref == 'develop' &&
+      startsWith(github.event.pull_request.head.ref, 'release/')
+    runs-on: ubuntu-latest
+    env:
+      REPO: ${{ github.repository }}
+      ACTOR: ${{ github.event.review.user.login }}
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
+
+    steps:
+      - name: Check approval status
+        id: approvals
+        run: |
+          set -euo pipefail
+          pr_number="${{ github.event.pull_request.number }}"
+          decision=$(gh pr view --repo "${REPO}" "${pr_number}" --json reviewDecision -q '.reviewDecision')
+          echo "PR #${pr_number} review decision: ${decision}"
+          if [ "${decision}" = "APPROVED" ]; then
+            echo "should_finish=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "PR is not fully approved yet. Waiting."
+            echo "should_finish=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout repository
+        if: steps.approvals.outputs.should_finish == 'true'
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ssh-key: ${{ secrets.RDKCM_DEPLOY_KEY }}
+
+      - name: Install release tools
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y git-flow
+
+      - name: Configure git identity
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          git config user.name "${ACTOR}"
+          git config user.email "${ACTOR}@users.noreply.github.com"
+
+      - name: Finish release and push
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          release_version="${RELEASE_BRANCH#release/}"
+
+          git fetch --prune origin
+
+          # Skip if tag already exists
+          if git ls-remote --exit-code --tags origin "refs/tags/${release_version}" >/dev/null 2>&1; then
+            echo "Tag ${release_version} already exists on origin. Skipping release finish."
+            exit 0
+          fi
+
+          # Checkout the release branch
+          if git show-ref --verify --quiet "refs/heads/${RELEASE_BRANCH}"; then
+            git checkout "${RELEASE_BRANCH}"
+          elif git ls-remote --exit-code --heads origin "${RELEASE_BRANCH}" >/dev/null 2>&1; then
+            git checkout -b "${RELEASE_BRANCH}" "origin/${RELEASE_BRANCH}"
+          else
+            echo "${RELEASE_BRANCH} does not exist locally or on origin."
+            exit 1
+          fi
+
+          # Ensure main and develop exist locally
+          git checkout main 2>/dev/null || git checkout -b main origin/main
+          git checkout develop 2>/dev/null || git checkout -b develop origin/develop
+          git checkout "${RELEASE_BRANCH}"
+
+          # Initialize git-flow
+          git flow init -d
+
+          # Finish release: merges to main + develop, creates tag
+          git flow release finish -m "Release ${release_version}" "${release_version}"
+          git push origin main
+          git push origin --tags
+          git push origin develop
+          git push origin --delete "${RELEASE_BRANCH}" || true
+
+      - name: Close the release PR
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          pr_number="${{ github.event.pull_request.number }}"
+          gh pr close "${pr_number}" --repo "${REPO}" --comment "Release finished by automation. Merged via git flow release finish." || true
+
+      - name: Workflow summary
+        if: always()
+        run: |
+          {
+            echo "## Release Finish On Approval"
+            echo "- Repository: ${REPO}"
+            echo "- Release branch: ${RELEASE_BRANCH}"
+            echo "- Triggered by review: ${{ github.event.review.state }}"
+            echo "- Finished release: ${{ steps.approvals.outputs.should_finish || 'false' }}"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/component-release-workflow-usage.md

@@ -0,0 +1,103 @@
+# Automated Release Workflow
+
+Automates main release and hotfix flows via GitHub Actions.
+
+## Workflows
+
+### 1. Component Release (`component-release.yml`)
+
+Triggered manually from the **Actions** tab via `workflow_dispatch`.
+
+#### Inputs
+
+| Input | Required | Description |
+|-------|----------|-------------|
+| `release_version` | Yes | Release version (for example: `5.2.0`, `5.2.0-rc1`) |
+| `release_type` | Yes | `main` or `hotfix` |
+| `release_mode` | Yes | `approvable` or `auto-complete` (ignored for hotfix) |
+| `source_branch` | Hotfix only | Support branch for hotfix (for example: `support/5.0`) |
+
+#### Concurrency
+
+Runs are serialized per release key:
+
+- `component-release-<release_type>-<release_version>`
+
+This prevents two runs for the same version/type from racing on branches/tags.
+
+#### Release Modes
+
+**Main release - auto-complete**
+1. Validates version format.
+2. Runs `git flow release start` -> changelog -> `release publish` -> `release finish`.
+3. Pushes `main`, `develop`, and tags.
+
+**Main release - approvable**
+1. Validates version format.
+2. Runs `git flow release start` -> changelog -> `release publish`.
+3. Creates a PR: `release/<version>` -> `develop`.
+4. Stops and waits for PR approval.
+5. On approval, the second workflow finishes the release.
+
+**Hotfix (always auto-complete)**
+1. Requires `source_branch` input.
+2. Validates `source_branch` against `^[A-Za-z0-9._/-]+$`.
+3. Creates/uses `hotfix/<version>` from `source_branch`, updates changelog, merges back into `source_branch` only.
+4. Creates tag `<version>`.
+5. Pushes only `source_branch` and tag (`main`/`develop` are not pushed).
+
+### 2. Component Release Finish On Approval (`component-release-finish-on-approval.yml`)
+
+Triggered on approved review for `release/*` PRs targeting `develop`.
+
+#### What it does
+1. Verifies PR review decision is `APPROVED`.
+2. Checks out release branch.
+3. Runs `git flow release finish` (merge to `main` + `develop`, create tag).
+4. Pushes `main`, `develop`, and tags.
+5. Closes the release PR.
+
+## Authentication and Secrets
+
+Both workflows use:
+
+- `RDKCM_DEPLOY_KEY`: SSH private key used by checkout and git push operations.
+- `github.token`: built-in GitHub Actions token used by `gh` API/CLI calls.
+
+Why `github.token`:
+
+- It is automatically provided for each workflow run.
+- It avoids introducing a custom repository secret for API access.
+- It works with the workflow permissions already declared in these jobs.
+
+## Failure Cleanup Safety
+
+On failure, cleanup only removes refs created by the current run:
+
+- Deletes tag only if the run created that tag.
+- Deletes `release/<version>` only if the run created that local release branch.
+- Deletes `hotfix/<version>` only if the run created that local hotfix branch.
+- Skips cleanup if repository checkout is unavailable.
+
+## Prerequisites
+
+### Repository Settings
+
+- **Settings -> Actions -> General -> Workflow permissions**: set to **Read and write permissions**.
+- **Settings -> Actions -> General**: enable **Allow GitHub Actions to create and approve pull requests**.
+
+### Branch Protection
+
+- For approvable flow: enforce PR review rules on `develop`.
+- For auto-complete flow pushes to `develop`: ensure the automation actor has appropriate bypass rights in repository rules.
+
+## Version Format
+
+Accepted examples:
+
+- `5.2.0`
+- `5.2.0-rc1`
+- `5.2.0v1`
+- `5.2.0.beta2`
+
+Rule: `major.minor.patch` digits with optional suffix.