branch-cleanup.yml

# This workflow automatically deletes the branch associated with a pull request
# after it has been merged, unless the branch is protected (e.g., main, dev, staging).
# It helps keep the repository clean by removing merged feature or bugfix branches.

name: Branch Cleanup

on:
  pull_request:
    types: [closed]

permissions:
  contents: write
  pull-requests: read

jobs:
  cleanup:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Delete merged branch
        if: github.event.pull_request.merged == true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
          REPOSITORY: ${{ github.repository }}
        run: |
          echo "Checking branch: $BRANCH_NAME"
          
          # Protected branch check - using quotes to prevent injection
          if [[ "$BRANCH_NAME" =~ ^(main|master|dev|develop|staging|production)$ ]]; then
            echo "::warning::Skipping deletion of protected branch: $BRANCH_NAME"
            exit 0
          fi
          
          # Attempt branch deletion - using quotes to prevent injection
          echo "Attempting to delete branch: $BRANCH_NAME"
          if git push origin --delete "$BRANCH_NAME" 2>/dev/null; then
            echo "::notice::Successfully deleted branch: $BRANCH_NAME"
          else
            echo "::error::Failed to delete branch: $BRANCH_NAME"
            exit 1
          fi