sync-branch.yaml

name: Sync release branch with main

on:
  workflow_dispatch:
    inputs:
      branch_name:
        description: Release branch to update
        required: true
        type: string

      # Inputs provided by the bot
      distinct_id:
        description: '(bot) A distinct ID'
        required: false
        default: ''
      source_issue:
        description: '(bot) The issue that triggered this workflow'
        required: false
        default: ''
      requesting_user:
        description: '(bot) The user who requested this workflow'
        required: false
        default: ''
      status_comment:
        description: '(bot) The comment to update with the status of this workflow'
        required: false
        default: ''

run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0})', inputs.distinct_id) || '' }}

permissions:
  contents: read
  id-token: write

defaults:
  run:
    shell: bash

jobs:
  sync:
    if: github.repository == 'microsoft/TypeScript'
    runs-on: ubuntu-latest
    environment:
      name: azure
      deployment: false

    steps:
      - name: Validate release branch name
        env:
          BRANCH_NAME: ${{ inputs.branch_name }}
        run: |
          set -euo pipefail
          if ! [[ "$BRANCH_NAME" =~ ^(release-.+|ts[0-9]+-release)$ ]]; then
            echo "Release branch name must start with 'release-' or match 'ts<number>-release'." >&2
            exit 1
          fi
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.branch_name }}
          filter: blob:none
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
      - uses: ./.github/actions/setup-go
      - name: Merge main
        env:
          BRANCH_NAME: ${{ inputs.branch_name }}
        run: |
          set -euo pipefail
          releaseVersion="$(node -e '
            const source = require("node:fs").readFileSync("tsc/internal/core/version.go", "utf8");
            const match = source.match(/var version = "([^"]+)"/);
            if (!match) throw new Error("Unable to read the release version");
            process.stdout.write(match[1]);
          ')"
          git config user.email "290192711+typescript-automation[bot]@users.noreply.github.com"
          git config user.name "typescript-automation[bot]"
          git config core.hooksPath /dev/null
          git fetch origin main
          git show origin/main:tools/scripts/configure-release.mjs > "$RUNNER_TEMP/configure-release.mjs"

          if ! git merge origin/main --no-ff --no-commit; then
            mapfile -t conflictedFiles < <(git diff --name-only --diff-filter=U)
            allowedConflicts=("Herebyfile.mjs" "tsc/internal/core/version.go")
            for conflictedFile in "${conflictedFiles[@]}"; do
              if [[ ! " ${allowedConflicts[*]} " =~ " $conflictedFile " ]]; then
                echo "Merge conflict requires manual resolution: $conflictedFile" >&2
                exit 1
              fi
            done
            if [ "${#conflictedFiles[@]}" -eq 0 ]; then
              echo "Merge failed without reporting conflicted files." >&2
              exit 1
            fi
            git checkout --theirs -- "${conflictedFiles[@]}"
          fi

          node "$RUNNER_TEMP/configure-release.mjs" "$releaseVersion"
          git add Herebyfile.mjs tsc/internal/core/version.go
          if git rev-parse --verify --quiet MERGE_HEAD >/dev/null; then
            git commit --no-edit
          elif ! git diff --cached --quiet; then
            git commit -m "Restore release configuration after syncing main"
          fi
      - run: npm ci
      - run: npx hereby validate --all
      - name: Verify clean merge
        run: |
          set -euo pipefail
          git diff --check
          if ! git diff --quiet || ! git diff --cached --quiet; then
            echo "Validation modified the worktree; refusing to push the merge." >&2
            git status --short
            exit 1
          fi
      - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        if: ${{ !cancelled() }}
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      - name: Create GitHub App token
        if: ${{ !cancelled() }}
        id: app-token
        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
        with:
          client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
          key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
          owner: microsoft
          repositories: TypeScript
          permission-contents: write
          permission-issues: write
      - name: Configure git for GitHub App token
        env:
          GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          set -euo pipefail
          basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
          echo "::add-mask::$basic_auth"
          git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
      - env:
          BRANCH_NAME: ${{ inputs.branch_name }}
        run: git push origin "HEAD:$BRANCH_NAME"

      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@08bcbbf253fd6bc533dd8b9ab47a58582be57fbe # master
        if: ${{ !cancelled() && inputs.distinct_id }}
        with:
          success_comment: "I've pulled main into ${{ inputs.branch_name }} for you."
          failure_comment: 'I was unable to merge main into ${{ inputs.branch_name }}.'
          github_token: ${{ steps.app-token.outputs.token }}
          distinct_id: ${{ inputs.distinct_id }}
          source_issue: ${{ inputs.source_issue }}
          requesting_user: ${{ inputs.requesting_user }}
          status_comment: ${{ inputs.status_comment }}