release_housekeeping.yml

name: Prepare post-release housekeeping

on:
  workflow_call:
    inputs:
      tag:
        required: true
        type: string
      release_commit:
        required: true
        type: string

permissions:
  contents: read # Restrictive default
  pull-requests: read # List associated preparation PRs during state checks

concurrency:
  group: release-housekeeping
  queue: max
  cancel-in-progress: false

jobs:
  housekeeping:
    name: Begin the next development version and push to master
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      RELEASE_COMMIT: ${{ inputs.release_commit }}
    steps:
      - name: Checkout master
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: master
          fetch-depth: 0
          persist-credentials: false

      - name: Record base
        id: base
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Set up housekeeping tooling
        uses: ./.github/actions/setup
        with:
          rust: true
          cargo-cache: true
          protoc: true
          dd-rust-license-tool: true
          vdev: true

      - name: Check housekeeping state
        id: state
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: >-
          "$VDEV" release workflow housekeeping-check
          --tag "$RELEASE_TAG" --release-commit "$RELEASE_COMMIT"
          --repository "$GITHUB_REPOSITORY"

      - name: Require active release freeze
        if: steps.state.outputs.skip != 'true'
        uses: ./.github/actions/require-release-freeze
        with: &release-bot
          app-client-id: ${{ secrets.GH_APP_VECTORDOTDEV_BOT_CLIENT_ID }}
          app-private-key: ${{ secrets.GH_APP_VECTORDOTDEV_BOT_APP_PRIVATE_KEY }}
          freeze-ruleset-id: ${{ vars.RELEASE_FREEZE_RULESET_ID }}
          bot-bypass-ruleset-ids: ${{ vars.RELEASE_FREEZE_BOT_BYPASS }}

      - name: Generate housekeeping
        if: steps.state.outputs.skip != 'true'
        env:
          VERSION: ${{ steps.state.outputs.version }}
        run: >-
          "$VDEV" release workflow housekeeping-prepare
          --version "$VERSION"

      - name: Install VRL documentation builder
        if: steps.state.outputs.skip != 'true'
        uses: ./.github/actions/install-vrl-doc-builder

      - name: Refresh dependency files
        if: steps.state.outputs.skip != 'true'
        run: make build-licenses generate-vector-vrl-docs

      - name: Check for changes
        id: changes
        run: |
          set -euo pipefail
          # Stage exactly the files housekeeping owns so both modified and newly
          # created documentation files are detected; git diff alone ignores
          # untracked files. Anything else the tooling touched is left unstaged
          # and fails the validation below.
          git add -A -- Cargo.toml Cargo.lock LICENSE-3rdparty.csv docs/generated
          if git diff --cached --quiet; then
            echo "Master already begins the next development version; nothing to do."
            exit 0
          fi
          echo "changed=true" >> "$GITHUB_OUTPUT"

      - name: Create Vector bot token
        if: steps.changes.outputs.changed == 'true'
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.GH_APP_VECTORDOTDEV_BOT_CLIENT_ID }}
          private-key: ${{ secrets.GH_APP_VECTORDOTDEV_BOT_APP_PRIVATE_KEY }}
          permission-contents: write

      - name: Require active release freeze
        if: steps.changes.outputs.changed == 'true'
        uses: ./.github/actions/require-release-freeze
        with: *release-bot

      - name: Push housekeeping to master
        if: steps.changes.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          BASE_SHA: ${{ steps.base.outputs.sha }}
          VERSION: ${{ steps.state.outputs.version }}
        run: |
          set -euo pipefail
          # All remote git operations go through the token-authenticated URL. The
          # checkout ran with persist-credentials: false, so origin has no credentials.
          remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"

          master=$(git ls-remote "$remote" refs/heads/master)
          master=${master%%$'\t'*}
          [[ "$master" == "$BASE_SHA" ]] || {
            echo "master moved since housekeeping was generated; re-run this workflow." >&2
            exit 1
          }

          git config user.name "vectordotdev-bot[bot]"
          git config user.email "vectordotdev-bot[bot]@users.noreply.github.com"
          # Commit only the generated changes staged by the Check for changes
          # step; nothing else is committed.
          git commit -m "chore(releasing): housekeeping after v${VERSION}"

          # Validate the checked housekeeping commit exactly as the release PR
          # checklist would: only the version bump, the VRL main restoration, and
          # dependency and documentation refreshes on the frozen base.
          "$VDEV" release workflow housekeeping-validate \
            --version "$VERSION" --base-sha "$BASE_SHA"

          # Plain non-force push: if master raced ahead since the check above,
          # the push is rejected rather than rewriting history. Re-run this
          # workflow from the new master; never rebase, retry, or force-push.
          git push "$remote" HEAD:refs/heads/master

          echo "Pushed housekeeping commit $(git rev-parse HEAD) to master after v${VERSION}." >> "$GITHUB_STEP_SUMMARY"