run-patch-release.yml

---
name: run-patch-release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'The current version to be released, normally the `FF version` (semver format: major.minor.patch)'
        required: true
        type: string

# Avoid concurrency so we can watch the releases correctly
concurrency:
  group: ${{ github.workflow }}

permissions:
  contents: read

env:
  JOB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
  SLACK_CHANNEL: "#apm-server"

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      release-branch: ${{ steps.prepare.outputs.release-branch }}
      release-type: ${{ steps.prepare.outputs.release-type }}
      release-version: ${{ steps.prepare.outputs.release-version }}
      slack-thread: ${{ steps.prepare.outputs.slack-thread }}
    steps:
      - uses: actions/checkout@v4

      - id: prepare
        uses: ./.github/workflows/prepare-release
        with:
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          version: ${{ inputs.version }}
          type: 'patch'

  run-patch:
    runs-on: ubuntu-latest
    needs: [ prepare ]
    env:
      RELEASE_BRANCH: ${{ needs.prepare.outputs.release-branch }}
      RELEASE_TYPE: ${{ needs.prepare.outputs.release-type }}
      RELEASE_VERSION: ${{ needs.prepare.outputs.release-version }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          # 0 indicates all history for all branches and tags.
          fetch-depth: 0
          # Use the makefile in the given release branch.
          ref: ${{ env.RELEASE_BRANCH }}

      - name: Get token
        id: get_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        with:
          app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }}
          private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }}
          permissions: >-
            {
              "contents": "write",
              "pull_requests": "write"
            }

      # Required to use a service account, otherwise PRs created by
      # GitHub bot won't trigger any CI builds.
      # See https://github.com/peter-evans/create-pull-request/issues/48#issuecomment-537478081
      - name: Configure git user
        uses: elastic/oblt-actions/git/setup@v1
        with:
          github-token: ${{ steps.get_token.outputs.token }}

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5  # v6.2.0
        with:
          gpg_private_key: ${{ secrets.APM_SERVER_RELEASE_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.APM_SERVER_RELEASE_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true

      - run: make patch-release
        env:
          GH_TOKEN: ${{ steps.get_token.outputs.token }}

      - if: success()
        uses: elastic/oblt-actions/slack/send@v1
        with:
          bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          channel-id: ${{ env.SLACK_CHANNEL }}
          message: |-
            Feature freeze for `${{ github.repository }}@${{ env.RELEASE_VERSION }}` is Today.
            All the relevant PRs and issues have been created.
          thread-timestamp: ${{ needs.prepare.outputs.slack-thread || '' }}

      - if: failure()
        uses: elastic/oblt-actions/slack/send@v1
        with:
          bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          channel-id: ${{ env.SLACK_CHANNEL }}
          message: |-
            :fire: Something went wrong with the patch release. See <${{ env.JOB_URL }}|logs>.
          thread-timestamp: ${{ needs.prepare.outputs.slack-thread || '' }}