create-linked-release.yml

name: Create Linked Tags from Upstream Repo

on:
  schedule:
    # Runs 4 times a day (every 6 hours)
    - cron: '0 */6 * * *'

  # A simple manual trigger for testing.
  workflow_dispatch:

permissions:
  # 'contents: write' is required to push tags to the repository.
  contents: write

jobs:
  sync-tag:
    runs-on: ubuntu-latest

    steps:
      - name: Get latest releases per major from public upstream repo
        id: get_releases
        uses: ophiosdev/github-action-latest-release@master
        with:
          # Reads the UPSTREAM_REPO variable from your repository settings.
          # This variable is REQUIRED for the workflow to function.
          repository: ${{ vars.UPSTREAM_REPO }}
          includes: ${{ vars.VERSION_REGEX || '^v?[0-9]+\.[0-9]+\.[0-9]+$' }}
          # With groupBy=major the 'release' output is a JSON array holding the
          # latest release per major, e.g. [{release: v2.2.5}, {release: v1.19.5}].
          groupBy: major
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build tag plan
        id: plan_tags
        env:
          RELEASES_JSON: ${{ steps.get_releases.outputs.release }}
        run: |
          set -euo pipefail

          # No releases reported → nothing to do, silently.
          if [[ -z "$RELEASES_JSON" || "$RELEASES_JSON" == "null" ]]; then
            echo "pairs=[]" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Latest v1.x release goes to the v1 branch, every other major > 1
          # gets its own tag on master. Everything else (e.g. v0.x) is ignored.
          pairs="$(
            printf '%s' "$RELEASES_JSON" | jq -c '
              def norm: "v" + (. | sub("^v"; ""));
              map({tag: (.release | norm), major: (.release | ltrimstr("v") | split(".")[0] | tonumber)}) as $all
              | [($all[] | select(.major == 1) | {tag, branch: "v1"})]
                + [($all[] | select(.major > 1) | {tag, branch: "master"})]
            '
          )"

          if [[ "$pairs" == "[]" ]]; then
            echo "pairs=[]" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "pairs=$pairs" >> "$GITHUB_OUTPUT"

      - name: Generate GitHub App token
        id: app_token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.WORKFLOW_APP_ID }}
          private-key: ${{ secrets.WORKFLOW_APP_PRIVATE_KEY }}

      - name: Checkout repository code
        # We need to check out the code to be able to check for existing tags and push new ones.
        if: steps.plan_tags.outputs.pairs != '[]'
        uses: actions/checkout@v7
        with:
          # Full fetch so tags resolve to the head of both branches.
          fetch-depth: 0
          fetch-tags: true
          token: ${{ steps.app_token.outputs.token }}

      - name: Create and push new tags
        # Skips tags that already exist; never moves an existing tag
        # (tag advancement is owned by advance-tags.yml).
        if: steps.plan_tags.outputs.pairs != '[]'
        env:
          PAIRS: ${{ steps.plan_tags.outputs.pairs }}
        run: |
          set -euo pipefail

          printf '%s' "$PAIRS" | jq -c '.[]' | while read -r entry; do
            tag="$(jq -r '.tag' <<<"$entry")"
            branch="$(jq -r '.branch' <<<"$entry")"
            target="$(git rev-parse --verify "refs/remotes/origin/$branch")"

            if git rev-parse --verify --quiet "refs/tags/$tag"; then
              echo "Tag '$tag' already exists. No action needed."
              continue
            fi

            echo "Creating tag '$tag' at head of '$branch' (${target:0:7})."
            git tag "$tag" "$target"
            git push origin "$tag"
            echo "Successfully created and pushed tag '$tag'."
          done