name: Backport Merged Pull Requests

on:
  pull_request_target:
    types: [closed]

permissions: {}

jobs:
  cherry-pick:
    # Ensures the PR was actually merged AND has the correct backport label
    if: |
      github.event.pull_request.merged == true &&
      contains(github.event.pull_request.labels.*.name, 'cherry-pick')

    runs-on: ubuntu-slim

    steps:
      - name: Generate a GitHub App Token
        id: generate-token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
        with:
          client-id: ${{ secrets.AURORABOT_APP_ID }}
          private-key: ${{ secrets.AURORABOT_PRIVATE_KEY }}
          repositories: ${{ github.event.repository.name }}
          permission-contents: write
          permission-pull-requests: write

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # The backport action needs the creds to be available for pushing the backport PRs
          persist-credentials: true
          # Use the dynamically generated GitHub App token
          token: ${{ steps.generate-token.outputs.token }}
          # Explicitly check out the base branch (the PR is already merged into it).
          # Avoids the default `refs/pull/<PR>/merge` ref, which actions/checkout
          # refuses to check out for fork PRs on pull_request_target events.
          ref: ${{ github.event.pull_request.base.ref }}
          fetch-depth: 0

      - name: Configure Git Author
        run: |
          git config --global user.name "Aurora-Backport[bot]"
          git config --global user.email "aurora-backport[bot]@users.noreply.github.com"

      - name: Create Backport Pull Requests
        id: backport
        uses: korthout/backport-action@8560fb503c275d433c56f05a2f64850093baa9f7 # v4.7.0
        with:
          # Use the dynamically generated GitHub App token here too
          github_token: ${{ steps.generate-token.outputs.token }}
          target_branches: ${{ vars.STABLE_BRANCH }}
          add_labels: "backported-to-stable"
          pull_title: '${pull_title} [Backport ${target_branch}]'
          pull_description: |
            This is an automated backport of PR #${pull_number} to `${target_branch}`.

            **_Please review the changes._**

            ### Original PR Description:
            ${pull_description}

      - name: Fail if backport was unsuccessful
        if: steps.backport.outputs.was_successful == 'false'
        run: |
          echo "::error::Backport PR creation failed (e.g. cherry-pick conflicts). Check the step above for details."
          exit 1