ca-template-changes.yml

name: CA template changes

on:
  release:
    types: [published]

# Every write is the app token's, which is also what makes the checks run on
# the pull request this opens.
permissions: {}

jobs:
  update:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Mint a token for the release app
        id: app
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      # Branch from the default branch, not the tag the release points at: a
      # tag checkout is detached and the push would go nowhere.
      - name: Checkout default branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '24'

      # Reads the newest dated section, never [Unreleased]. See scripts/ca-changes.js.
      - name: Write the newest release notes into the template
        id: changes
        run: node scripts/ca-changes.js >> "$GITHUB_OUTPUT"

      # Python's standard library: the runner image carries no xmllint.
      - name: Check the result is still well-formed
        if: steps.changes.outputs.changed == 'true'
        env:
          REPO: ${{ github.repository }}
          BASE: ${{ github.event.repository.default_branch }}
        run: python3 scripts/ca-validate.py "$REPO" "$BASE"

      # The checkout keeps no credentials, so the token authenticates this one
      # push and is never left in the runner's git config.
      #
      # A pull request, never a direct push: the default branch requires one.
      - name: Open a pull request
        if: steps.changes.outputs.changed == 'true'
        env:
          VERSION: ${{ github.event.release.tag_name }}
          BASE: ${{ github.event.repository.default_branch }}
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ steps.app.outputs.token }}
        run: |
          set -euo pipefail
          BRANCH="docs/ca-template-${VERSION}"
          git config user.name 'SandObserver'
          git config user.email '260779319+SandObserver@users.noreply.github.com'
          git checkout -b "${BRANCH}"
          git add templates/stackyard.xml
          git commit -m "Docs: describe ${VERSION} in the Community Applications template"
          git push "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "HEAD:${BRANCH}"
          gh pr create \
            --base "${BASE}" \
            --head "${BRANCH}" \
            --title "Docs: describe ${VERSION} in the Community Applications template" \
            --label documentation \
            --body "$(printf '%s\n' \
              '**Summary**' \
              "- Copy the ${VERSION} changelog section into the Community Applications template." \
              '' \
              '**Testing**' \
              'The template was validated as well-formed before this branch was pushed.' \
              '' \
              '**Checklist**' \
              '- [x] Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).' \
              '- [ ] Tests added or updated for new logic, and the full suite, lint, and typechecks pass.' \
              '- [x] Docs updated if behavior or configuration changed.' \
              '- [ ] CHANGELOG.md updated under Unreleased if the change is user-visible.')"