create-release-branch.yml

name: Create Release Branch

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v1.83.0-stable) — branch will be named release/<tag>"
        required: true
        type: string
      commit_hash:
        description: "Full 40-char commit SHA the branch should point to"
        required: true
        type: string
  workflow_call:
    inputs:
      tag:
        description: "Release tag"
        required: true
        type: string
      commit_hash:
        description: "Full 40-char commit SHA the branch should point to"
        required: true
        type: string

permissions: {}

jobs:
  create-branch:
    name: Create Release Branch
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Validate inputs
        env:
          TAG: ${{ inputs.tag }}
          COMMIT_HASH: ${{ inputs.commit_hash }}
        run: |
          if ! echo "${COMMIT_HASH}" | grep -qE '^[0-9a-f]{40}$'; then
            echo "::error::commit_hash must be a full 40-character commit SHA"
            exit 1
          fi
          if ! echo "${TAG}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+'; then
            echo "::error::tag must start with vX.Y.Z"
            exit 1
          fi

      - name: Create release branch
        env:
          TAG: ${{ inputs.tag }}
          COMMIT_HASH: ${{ inputs.commit_hash }}
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const tag = process.env.TAG;
            const commitHash = process.env.COMMIT_HASH;
            const branchName = `release/${tag}`;

            await github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: `refs/heads/${branchName}`,
              sha: commitHash,
            });
            core.info(`Created branch ${branchName} at ${commitHash}`);