tag-on-openapi-merge.yaml

name: tag on openapi merge

# When an openapi-auto-update PR (from update-openapi.yaml) is merged, tag the merge
# commit with the matching Bee version (vX.Y.Z). That tag is what gh-pages.yaml deploys on.
#
# Requires the BOT_PAT secret (same token as update-openapi.yaml). It is used so the tag
# push triggers gh-pages.yaml — a tag pushed with the default GITHUB_TOKEN does NOT trigger
# other workflows. The job fails loudly if BOT_PAT is missing/expired.

on:
  pull_request:
    types: [closed]

permissions:
  contents: write

jobs:
  tag:
    if: >-
      github.event.pull_request.merged == true &&
      contains(github.event.pull_request.labels.*.name, 'openapi-auto-update') &&
      startsWith(github.event.pull_request.head.ref, 'bot/update-openapi-')
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.ref }}
          fetch-depth: 0
          token: ${{ secrets.BOT_PAT }}

      - name: Derive tag from branch
        id: tag
        env:
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          set -euo pipefail
          NEW_TAG="${HEAD_REF#bot/update-openapi-}"
          if ! echo "$NEW_TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "Refusing to tag: '$NEW_TAG' is not a vX.Y.Z tag" >&2
            exit 1
          fi
          echo "new_tag=$NEW_TAG" >> "$GITHUB_OUTPUT"

      - name: Create and push tag
        env:
          NEW_TAG: ${{ steps.tag.outputs.new_tag }}
        run: |
          set -euo pipefail
          if git rev-parse -q --verify "refs/tags/${NEW_TAG}" >/dev/null; then
            echo "Tag ${NEW_TAG} already exists — nothing to do."
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag "$NEW_TAG"
          git push origin "$NEW_TAG"