name: Backport

on:
  pull_request_target:
    types:
      - closed
      - labeled

jobs:
  backport:
    name: Backport
    runs-on: ubuntu-24.04
    # It triggers only when PR is already merged on either:
    #
    # - The merge event itself (action != labeled) or
    # - A label event with the right label (backport ...).
    #
    # The result will be that we can add the label before or after merge,
    # but the workflow will only run once the PR had been merged.
    if: >
      github.event.pull_request.merged &&
      (
        github.event.action != 'labeled' ||
        startsWith(github.event.label.name, 'backport')
      )
    steps:

      # This actions creates the github token using the postgrest app secrets
      - name: Create Github App Token
        id: app-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ vars.POSTGREST_CI_APP_ID }}
          private-key: ${{ secrets.POSTGREST_CI_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
          permission-workflows: write # required when backporting CI changes

      # This is required for backport action to cherry-pick the PR
      - name: Fetch PR ref
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          token: ${{ steps.app-token.outputs.token }}

      # Backport action that creates the PR with given settings
      - name: Create backport PR
        uses: korthout/backport-action@c656f5d5851037b2b38fb5db2691a03fa229e3b2 # v4.0.1
        with:
          github_token: ${{ steps.app-token.outputs.token }}
          pull_description: 'Backport for #${pull_number}.'
          pull_title: '${target_branch}: ${pull_title}'