backport-trigger.yml

# Backport trigger file adapted from https://github.com/xamarin/.github/blob/main/workflow-templates/backport-trigger/backport-trigger.yml
# This trigger file is used as the basis for testing backports within the backport-bot-action repo itself
name: Backport Trigger

on:
  issue_comment:
    types: [created]

jobs:
  setupBackport:
    runs-on: ubuntu-latest
    # GITHUB_TOKEN change from read-write to read-only on 2024-02-01 requiring permissions block
    # https://docs.opensource.microsoft.com/github/apps/permission-changes/
    # https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
    permissions:
      actions: none
      contents: read
      security-events: none
    if: github.event.issue.pull_request != '' && startswith(github.event.comment.body, '@gitbot backport')
    outputs:
      target_branch: ${{ steps.parse_comment.outputs.target_branch }}
    steps:
      - name: Parse Comment
        id: parse_comment
        shell: pwsh
        run: |
          Write-Host "Parsing $env:COMMENT"
          ($botName, $backport, $backportTargetBranch) = [System.Text.RegularExpressions.Regex]::Split("$env:COMMENT", "\s+")
          Write-Host "GITHUB_OUTPUT: ${env:GITHUB_OUTPUT}"
          [IO.File]::AppendAllText($env:GITHUB_OUTPUT, "target_branch=${backportTargetBranch}$([Environment]::NewLine)")                 # Equivalent to the deprecated ::set-output command: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idoutputs
        env:
          COMMENT: "${{ github.event.comment.body }}"

  launchBackportBuild:
    needs: setupBackport
    uses: xamarin/backport-bot-action/.github/workflows/backport-action.yml@v1.0-test
    # GITHUB_TOKEN change from read-write to read-only on 2024-02-01 requiring permissions block
    # https://docs.opensource.microsoft.com/github/apps/permission-changes/
    # https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
    permissions:
      actions: none
      contents: read
      security-events: none
      id-token: write           # The backport-action template being invoked requires this permission
    with:
      pull_request_url: ${{ github.event.issue.pull_request.url }}
      target_branch: ${{ needs.setupBackport.outputs.target_branch }}
      comment_author: ${{ github.actor }}
      github_repository: ${{ github.repository }}
      use_fork: false
    secrets:
      azure_tenant_id: ${{ secrets.BACKPORT_AZURE_TENANT_ID }}
      azure_subscription_id: ${{ secrets.BACKPORT_AZURE_SUBSCRIPTION_ID }}
      azure_client_id: ${{ secrets.BACKPORT_AZURE_CLIENT_ID }}
      ado_organization: ${{ secrets.ADO_PROJECTCOLLECTION }}
      ado_project: ${{ secrets.ADO_PROJECT }}
      backport_pipeline_id: ${{ secrets.BACKPORT_PIPELINEID }}
      github_account_pat: ${{ secrets.SERVICEACCOUNT_PAT }}