name: backport
on:
  pull_request_target:
    types: [closed, labeled]

permissions: {}

jobs:
  backport:
    permissions:
      contents: write
      pull-requests: write
    name: Backport Pull Request
    if: github.event.pull_request.merged
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: true
          # Check out the merged-into base branch by name. Without an explicit
          # ref, checkout resolves to the base tip SHA, which for a _merged_ PR
          # equals pull_request.merge_commit_sha and trips the
          # actions/checkout@v7 `allow-unsafe-pr-checkout` guard (false
          # positive: this is trusted base code, not fork PR code).
          ref: ${{ github.event.pull_request.base.ref }}

      - uses: actions/create-github-app-token@v3.2.0
        id: app-token
        with:
          app-id: ${{ vars.BACKPORT_APP }}
          private-key: ${{ secrets.BACKPORT_KEY }}

      - name: Create backport PR
        id: backport
        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
        with:
          pull_title: "backport: ${pull_title}"
          label_pattern: "^ci:backport ([^ ]+)$"
          github_token: ${{ steps.app-token.outputs.token }}

      - name: Enable automerge
        if: ${{ steps.backport.outputs.was_successful == 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CREATED_PULL_NUMBERS: ${{ steps.backport.outputs.created_pull_numbers }}
        run: |
          gh pr merge --rebase --auto "${CREATED_PULL_NUMBERS}"