@natjswenson/shipflow 0.2.6 → 0.3.1

package/templates/gitflow/hotfix-automerge.yml.tmpl

@@ -0,0 +1,65 @@
+name: auto-merge hotfix/*  to {{MAIN_BRANCH}}
+
+# Rendered by shipflow's apply.mjs from this template. Do not hand-edit
+# without also updating .github/shipflow.json's renderedTemplateHashes entry
+# for this file, or shipflow's next apply will refuse to overwrite it
+# (handEditDetected) until an explicit --force is passed. Commit both files
+# together in the same commit.
+#
+# GH_TOKEN uses config.release.releaseCredential, NOT a hardcoded
+# secrets.GITHUB_TOKEN, because of GitHub's loop-prevention rule: a PR
+# auto-merged via `gh pr merge --auto` run under the default GITHUB_TOKEN
+# completes (later, asynchronously, once checks pass) attributed to the
+# github-actions[bot] identity — and a `pull_request: closed` event
+# resulting from that bot-attributed merge does NOT trigger this or any
+# other workflow's `on: pull_request` handlers. Confirmed empirically:
+# an identical PR merged by a real, PAT-authenticated actor fired the
+# closed-event trigger immediately; one completed by GITHUB_TOKEN-enabled
+# auto-merge fired no run at all. releaseCredential must therefore name a
+# real PAT/App-installation-token secret (not GITHUB_TOKEN) for
+# label-release-pending to ever actually run.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, closed]
+    branches: [{{MAIN_BRANCH}}]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  # Enables native GitHub auto-merge on open/reopen/synchronize — this job
+  # does NOT wait for checks itself; it turns on auto-merge and exits. The
+  # actual merge happens asynchronously, later, whenever GitHub's own
+  # required-checks gate is satisfied (see the design's discussion of why a
+  # bespoke polling/blocking job was rejected).
+  auto-merge:
+    if: >-
+      github.event.action != 'closed' &&
+      startsWith(github.event.pull_request.head.ref, '{{HOTFIX_BRANCH_PREFIX}}')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enable auto-merge
+        run: gh pr merge --auto {{MERGE_FLAG}} "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}"
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}
+
+  # Fires once, when the hotfix PR actually merges (a separate event from
+  # the job above, which only *enables* auto-merge). Applies a durable
+  # release-pending label so a later, disconnected shipflow invocation can
+  # find this promotion and ask about a release — the merge completion has
+  # no live Claude session attached to react to it directly.
+  label-release-pending:
+    if: >-
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, '{{HOTFIX_BRANCH_PREFIX}}')
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Apply release-pending label
+        run: gh pr edit "${{ github.event.pull_request.number }}" --add-label release-pending --repo "${{ github.repository }}"
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}

package/templates/gitflow/hotfix-merge-back.yml.tmpl

@@ -0,0 +1,54 @@
+name: merge {{MAIN_BRANCH}} back to {{DEV_BRANCH}} after a hotfix
+
+# Rendered by shipflow's apply.mjs. See dev-to-main-automerge.yml.tmpl's header
+# comment for the general hand-edit/renderedTemplateHashes discipline — same rules
+# apply here.
+#
+# GitFlow's hotfix branches merge into BOTH main and develop — this is the
+# defining semantic of a hotfix, not an optional convention (confirmed via
+# research: git-flow CLI's own `hotfix finish` command does both merges
+# atomically). This job runs the develop-side merge automatically once the
+# main-side merge (hotfix-automerge.yml) lands.
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [{{MAIN_BRANCH}}]
+
+permissions:
+  contents: write
+
+jobs:
+  merge-back-to-dev:
+    if: >-
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, '{{HOTFIX_BRANCH_PREFIX}}')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}
+      - name: Attempt a clean merge of {{MAIN_BRANCH}} into {{DEV_BRANCH}}
+        id: merge
+        continue-on-error: true
+        run: |
+          git config user.name "shipflow"
+          git config user.email "shipflow@users.noreply.github.com"
+          git checkout {{DEV_BRANCH}}
+          git merge origin/{{MAIN_BRANCH}} --no-edit
+          git push origin {{DEV_BRANCH}}
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}
+      - name: On any failure (conflict, rejected push, or otherwise), open a PR for manual resolution
+        if: steps.merge.outcome == 'failure'
+        run: |
+          git merge --abort || true
+          BRANCH="shipflow/merge-back-{{MAIN_BRANCH}}-to-{{DEV_BRANCH}}-${{ github.run_id }}"
+          git checkout -b "$BRANCH" origin/{{MAIN_BRANCH}}
+          git push origin "$BRANCH"
+          gh pr create --base {{DEV_BRANCH}} --head "$BRANCH" \
+            --title "Manual merge-back needed: {{MAIN_BRANCH}} -> {{DEV_BRANCH}}" \
+            --body "Automatic merge-back failed (conflict or rejected push) after a hotfix/release merged to {{MAIN_BRANCH}}. Resolve and merge this PR manually."
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}

package/templates/gitflow/release-automerge.yml.tmpl

@@ -0,0 +1,65 @@
+name: auto-merge release/*  to {{MAIN_BRANCH}}
+
+# Rendered by shipflow's apply.mjs from this template. Do not hand-edit
+# without also updating .github/shipflow.json's renderedTemplateHashes entry
+# for this file, or shipflow's next apply will refuse to overwrite it
+# (handEditDetected) until an explicit --force is passed. Commit both files
+# together in the same commit.
+#
+# GH_TOKEN uses config.release.releaseCredential, NOT a hardcoded
+# secrets.GITHUB_TOKEN, because of GitHub's loop-prevention rule: a PR
+# auto-merged via `gh pr merge --auto` run under the default GITHUB_TOKEN
+# completes (later, asynchronously, once checks pass) attributed to the
+# github-actions[bot] identity — and a `pull_request: closed` event
+# resulting from that bot-attributed merge does NOT trigger this or any
+# other workflow's `on: pull_request` handlers. Confirmed empirically:
+# an identical PR merged by a real, PAT-authenticated actor fired the
+# closed-event trigger immediately; one completed by GITHUB_TOKEN-enabled
+# auto-merge fired no run at all. releaseCredential must therefore name a
+# real PAT/App-installation-token secret (not GITHUB_TOKEN) for
+# label-release-pending to ever actually run.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, closed]
+    branches: [{{MAIN_BRANCH}}]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  # Enables native GitHub auto-merge on open/reopen/synchronize — this job
+  # does NOT wait for checks itself; it turns on auto-merge and exits. The
+  # actual merge happens asynchronously, later, whenever GitHub's own
+  # required-checks gate is satisfied (see the design's discussion of why a
+  # bespoke polling/blocking job was rejected).
+  auto-merge:
+    if: >-
+      github.event.action != 'closed' &&
+      startsWith(github.event.pull_request.head.ref, '{{RELEASE_BRANCH_PREFIX}}')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enable auto-merge
+        run: gh pr merge --auto {{MERGE_FLAG}} "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}"
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}
+
+  # Fires once, when the release PR actually merges (a separate event from
+  # the job above, which only *enables* auto-merge). Applies a durable
+  # release-pending label so a later, disconnected shipflow invocation can
+  # find this promotion and ask about a release — the merge completion has
+  # no live Claude session attached to react to it directly.
+  label-release-pending:
+    if: >-
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, '{{RELEASE_BRANCH_PREFIX}}')
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Apply release-pending label
+        run: gh pr edit "${{ github.event.pull_request.number }}" --add-label release-pending --repo "${{ github.repository }}"
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}

package/templates/gitflow/release-merge-back.yml.tmpl

@@ -0,0 +1,54 @@
+name: merge {{MAIN_BRANCH}} back to {{DEV_BRANCH}} after a release
+
+# Rendered by shipflow's apply.mjs. See dev-to-main-automerge.yml.tmpl's header
+# comment for the general hand-edit/renderedTemplateHashes discipline — same rules
+# apply here.
+#
+# GitFlow's release branches merge into BOTH main and develop — this is the
+# defining semantic of a release, not an optional convention (confirmed via
+# research: git-flow CLI's own `release finish` command does both merges
+# atomically, mirroring hotfix finish). This job runs the develop-side merge
+# automatically once the main-side merge (release-automerge.yml) lands.
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [{{MAIN_BRANCH}}]
+
+permissions:
+  contents: write
+
+jobs:
+  merge-back-to-dev:
+    if: >-
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, '{{RELEASE_BRANCH_PREFIX}}')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}
+      - name: Attempt a clean merge of {{MAIN_BRANCH}} into {{DEV_BRANCH}}
+        id: merge
+        continue-on-error: true
+        run: |
+          git config user.name "shipflow"
+          git config user.email "shipflow@users.noreply.github.com"
+          git checkout {{DEV_BRANCH}}
+          git merge origin/{{MAIN_BRANCH}} --no-edit
+          git push origin {{DEV_BRANCH}}
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}
+      - name: On any failure (conflict, rejected push, or otherwise), open a PR for manual resolution
+        if: steps.merge.outcome == 'failure'
+        run: |
+          git merge --abort || true
+          BRANCH="shipflow/merge-back-{{MAIN_BRANCH}}-to-{{DEV_BRANCH}}-${{ github.run_id }}"
+          git checkout -b "$BRANCH" origin/{{MAIN_BRANCH}}
+          git push origin "$BRANCH"
+          gh pr create --base {{DEV_BRANCH}} --head "$BRANCH" \
+            --title "Manual merge-back needed: {{MAIN_BRANCH}} -> {{DEV_BRANCH}}" \
+            --body "Automatic merge-back failed (conflict or rejected push) after a hotfix/release merged to {{MAIN_BRANCH}}. Resolve and merge this PR manually."
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}

package/templates/github-flow/main-automerge.yml.tmpl

@@ -0,0 +1,66 @@
+name: auto-merge to {{MAIN_BRANCH}}
+
+# Rendered by shipflow's apply.mjs from this template. Do not hand-edit
+# without also updating .github/shipflow.json's renderedTemplateHashes entry
+# for this file, or shipflow's next apply will refuse to overwrite it
+# (handEditDetected) until an explicit --force is passed. Commit both files
+# together in the same commit.
+#
+# GitHub Flow has no separate "promotion" branch — every PR into {{MAIN_BRANCH}}
+# is eligible for auto-merge and every merge is release-worthy, so unlike
+# dev-main-promotion's template, neither job here restricts on head.ref.
+#
+# GH_TOKEN uses config.release.releaseCredential, NOT a hardcoded
+# secrets.GITHUB_TOKEN, because of GitHub's loop-prevention rule: a PR
+# auto-merged via `gh pr merge --auto` run under the default GITHUB_TOKEN
+# completes (later, asynchronously, once checks pass) attributed to the
+# github-actions[bot] identity — and a `pull_request: closed` event
+# resulting from that bot-attributed merge does NOT trigger this or any
+# other workflow's `on: pull_request` handlers. Confirmed empirically:
+# an identical PR merged by a real, PAT-authenticated actor fired the
+# closed-event trigger immediately; one completed by GITHUB_TOKEN-enabled
+# auto-merge fired no run at all. releaseCredential must therefore name a
+# real PAT/App-installation-token secret (not GITHUB_TOKEN) for
+# label-release-pending to ever actually run.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, closed]
+    branches: [{{MAIN_BRANCH}}]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  # Enables native GitHub auto-merge on open/reopen/synchronize — this job
+  # does NOT wait for checks itself; it turns on auto-merge and exits. The
+  # actual merge happens asynchronously, later, whenever GitHub's own
+  # required-checks gate is satisfied (see the design's discussion of why a
+  # bespoke polling/blocking job was rejected).
+  auto-merge:
+    if: github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enable auto-merge
+        run: gh pr merge --auto {{MERGE_FLAG}} "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}"
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}
+
+  # Fires once, when a PR actually merges (a separate event from the job
+  # above, which only *enables* auto-merge). Applies a durable
+  # release-pending label so a later, disconnected shipflow invocation can
+  # find this merge and ask about a release — the merge completion has no
+  # live Claude session attached to react to it directly.
+  label-release-pending:
+    if: >-
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Apply release-pending label
+        run: gh pr edit "${{ github.event.pull_request.number }}" --add-label release-pending --repo "${{ github.repository }}"
+        env:
+          GH_TOKEN: ${{ secrets.{{RELEASE_CREDENTIAL_SECRET}} }}