リリースフローの自動化（release ブランチ作成・タグ付け・マージバックの無人化） #57

name: Prepare Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'リリースするバージョン(例: 1.2.0 / 1.2.0-beta.1)'
        required: true
        type: string

permissions:
  contents: read

jobs:
  prepare:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v7
        with:
          ref: develop
          token: ${{ steps.app-token.outputs.token }}

      - uses: dart-lang/setup-dart@v1

      - name: Bump version
        env:
          TZ: Asia/Tokyo
          VERSION: ${{ inputs.version }}
        run: dart run tool/bump_version.dart "$VERSION"

      - name: Create release branch
        env:
          VERSION: ${{ inputs.version }}
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git switch -c "release/$VERSION"
          git commit -am "chore(release): $VERSION"
          git push -u origin "release/$VERSION"

      - name: Open pull request
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          VERSION: ${{ inputs.version }}
        run: |
          gh pr create \
            --base main \
            --head "release/$VERSION" \
            --title "release: $VERSION" \
            --body "\`tool/bump_version.dart\` による自動生成。マージすると \`v$VERSION\` タグが作成され、pub.dev への公開と GitHub Release 作成まで自動実行される。"

name: Tag Release

on:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: tag-release
  cancel-in-progress: false

jobs:
  tag:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - uses: dart-lang/setup-dart@v1

      - name: Install dependencies
        run: dart pub get

      - name: Create tag if missing
        run: |
          version="$(dart run tool/print_version.dart)"
          if git rev-parse -q --verify "refs/tags/v$version" >/dev/null; then
            echo "Tag v$version already exists. Nothing to do."
            exit 0
          fi
          git tag "v$version"
          git push origin "v$version"

  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: dart-lang/setup-dart@v1

      - name: Verify tag commit is on main
        run: |
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
          git merge-base --is-ancestor "$GITHUB_SHA" origin/main

      - name: Verify release version
        run: dart run tool/verify_release.dart "${GITHUB_REF_NAME#v}"

  merge-back:
    needs: release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v7
        with:
          ref: develop
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Merge main back into develop
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main

          if git merge-base --is-ancestor origin/main HEAD; then
            echo "develop already contains main. Nothing to do."
            exit 0
          fi

          if git merge --no-ff -m "chore: merge back $GITHUB_REF_NAME into develop" origin/main \
            && git push origin develop; then
            echo "Merged main into develop."
            exit 0
          fi

          # 競合、またはブランチ保護により直接 push できない場合のフォールバック
          git merge --abort || true
          branch="chore/merge-back-$GITHUB_REF_NAME"
          git switch -c "$branch" origin/main
          git push -u --force-with-lease origin "$branch"
          gh pr create \
            --base develop \
            --head "$branch" \
            --title "chore: merge back $GITHUB_REF_NAME into develop" \
            --body "自動マージバックに失敗したため、手動での競合解決が必要。" \
            || echo "既存の PR があるため作成をスキップした。"
          exit 1