backport.yml

name: Backport PR Creator
on:
  pull_request:
    types:
      - closed
      - labeled

permissions:
  contents: read

jobs:
  main:
    runs-on: ubuntu-latest
    # For now, only run this on the main repo. 
    if: github.repository == 'grafana/alloy'
    # These permissions are needed to assume roles from Github's OIDC.
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout Actions
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          repository: "grafana/grafana-github-actions"
          path: ./actions
          # Pin the version to before https://github.com/grafana/grafana-github-actions/pull/113
          # to avoid the strict rules for PR labels.
          ref: d284afd314ca3625c23595e9f62b52d215ead7ce
          persist-credentials: false
      - name: Install Actions
        run: npm install --production --prefix ./actions
      - id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@5d7e361bc7e0a183cde8afe9899fb7b596d2659b # get-vault-secrets-v1.2.0
        with:
          repo_secrets: |
            ALLOYBOT_APP_ID=alloybot:app_id
            ALLOYBOT_PRIVATE_KEY=alloybot:private_key
          export_env: false
      
      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
        id: app-token
        with:
          app-id: ${{ fromJSON(steps.get-secrets.outputs.secrets).ALLOYBOT_APP_ID }}
          private-key: ${{ fromJSON(steps.get-secrets.outputs.secrets).ALLOYBOT_PRIVATE_KEY }}
          owner: grafana
          repositories: alloy

      - name: Get GitHub App
        env:
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        id: get-app
        run: |
          APP_ID="$(gh api "/apps/${APP_SLUG}" --jq .id)" || exit 1
          echo "app-id=${APP_ID}" >> "${GITHUB_OUTPUT}"
          echo "app-login=${APP_SLUG}[bot]" >> "${GITHUB_OUTPUT}"

      - name: Configure Git
        env:
          APP_ID: ${{ steps.get-app.outputs.app-id }}
          APP_LOGIN: ${{ steps.get-app.outputs.app-login }}
        run: |
          git config --global user.name "${APP_LOGIN}"
          git config --global user.email "${APP_ID}+${APP_LOGIN}@users.noreply.github.com"

      - name: Run backport
        uses: ./actions/backport
        with:
          token: ${{ steps.app-token.outputs.token }}
          labelsToAdd: "backport"
          title: "[{{base}}] {{originalTitle}}"