ci_updated_default_branch.yml

---
name: CI - New updates to default branch

on:
  push:
    branches:
    - develop

env:
  DEFAULT_REPO_BRANCH: develop

jobs:
  update-dependabot-branch:
    name: Update permanent dependabot branch
    if: github.repository_owner == 'aiidateam'
    runs-on: ubuntu-latest

    env:
      DEPENDABOT_BRANCH: ci/dependabot-updates
      GIT_USER_NAME: The AiiDA Team
      GIT_USER_EMAIL: developers@aiida.net

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        ref: ${{ env.DEPENDABOT_BRANCH }}
        fetch-depth: 0

    - name: Set up git config
      run: |
        git config --global user.name "${{ env.GIT_USER_NAME }}"
        git config --global user.email "${{ env.GIT_USER_EMAIL }}"

    - name: Update '${{ env.DEPENDABOT_BRANCH }}'
      run: |
        git fetch origin

        LATEST_PR_BODY="$(gh api /repos/${{ github.repository}}/pulls -X GET -f state=closed -f per_page=1 -f sort=updated -f direction=desc --jq '.[].body')"
        if [ "${LATEST_PR_BODY}" == "$(cat .github/utils/single_dependency_pr_body.txt)" ]; then
          # The dependency branch has just been merged into ${DEFAULT_REPO_BRANCH}
          # The dependency branch should be reset to ${DEFAULT_REPO_BRANCH}
          echo "The dependencies have just been updated! Reset to ${{ env.DEFAULT_REPO_BRANCH }}."
          git reset --hard origin/${{ env.DEFAULT_REPO_BRANCH }}
          echo "FORCE_PUSH=yes" >> $GITHUB_ENV
        else
          # Normal procedure: Merge ${DEFAULT_REPO_BRANCH} into `ci/dependabot-updates`
          echo "Merge new updates to ${{ env.DEFAULT_REPO_BRANCH }} into ${DEPENDABOT_BRANCH}"
          git merge -m "Keep '${{ env.DEPENDABOT_BRANCH }}' up-to-date with '${{ env.DEFAULT_REPO_BRANCH }}'" origin/${{ env.DEFAULT_REPO_BRANCH }}
          echo "FORCE_PUSH=no" >> $GITHUB_ENV
        fi
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Push to '${{ env.DEPENDABOT_BRANCH }}'
      uses: CasperWA/push-protected@v2
      with:
        token: ${{ secrets.RELEASE_PAT }}
        branch: ${{ env.DEPENDABOT_BRANCH }}
        sleep: 15
        force: ${{ env.FORCE_PUSH }}