autoapprove.yml

# This workflow auto approves the PR generated by the bump_version
# workflow, and moves the tag that was created in the PR's branch
# to develop.

name: github-actions auto-approve
on: pull_request_target

permissions:
  pull-requests: write
  contents: write

jobs:
  approve-bot:
    runs-on: ubuntu-latest
    if: ${{ github.event.pull_request.user.login == 'semgrep-ci[bot]'}}
    steps:
      - name: Approve
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Watch untill PR checks are done
        run: gh pr checks --required --watch  "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Merge PR
        run: gh pr merge --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Now we switch to semgrep-ci[bot] to actually be able to
      # move the tag we created in bump_version.yml from the
      # release branch to develop

      - id: token
        name: Get token for semgrep-ci GitHub App
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.SEMGREP_CI_CLIENT_ID }}
          private-key: ${{ secrets.SEMGREP_CI_APP_KEY }}
          owner: ${{ github.repository_owner }}

      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: develop
          token: ${{ steps.token.outputs.token }}

      - name: Move tag to develop branch
        env:
          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          CURR_VERSION=$(grep -o 'version=\"[0-9.]*\"' setup.py | sed "s/version=\"\([0-9.]*\)\"/\1/")
          # We tagged the release branch first in bump_version.yml
          # to allow tests to pass; now moving it to develop so
          # it can be a part of its history
          git push --delete origin "v${CURR_VERSION}"
          git tag "v${CURR_VERSION}" HEAD
          git push origin tag "v${CURR_VERSION}"