After a successful release-git run, close the corresponding PR

In Git for Windows' release process, there are always
`git-for-windows/git` PRs whose tip commit is slated to be tagged.

As part of the release process, after the `/git-artifacts`
slash command has concluded successfully and its artifacts have been
validated manually, the `/release` slash command is issued, which
triggers the `release-git` workflow run.

Once this `release-git` workflow run has succeeded, it is time to close
the PR. However, it must not be merged (which would throw the
merging-rebase automation) but instead the PR's tip revision needs to be
pushed as new tip commit of the `main` branch.

The code added in this commit accomplishes that.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

GitForWindowsHelper/finalize-g4w-release.js

@@ -0,0 +1,61 @@
+module.exports = async (context, req) => {
+    if (req.body.action !== 'completed') return "Nothing to do here: workflow run did not complete yet"
+    if (req.body.workflow_run.conclusion !== 'success') return "Nothing to do here: workflow run did not succeed"
+
+    const releaseWorkflowRunID = req.body.workflow_run.id
+    const owner = 'git-for-windows'
+    const repo = 'git'
+    const sender = req.body.sender.login
+
+    const getToken = (() => {
+        let token
+
+        const get = async () => {
+            const getInstallationIdForRepo = require('./get-installation-id-for-repo')
+            const installationId = await getInstallationIdForRepo(context, owner, repo)
+            const getInstallationAccessToken = require('./get-installation-access-token')
+            return await getInstallationAccessToken(context, installationId)
+        }
+
+        return async () => token || (token = await get())
+    })()
+
+    const isAllowed = async (login) => {
+        const getCollaboratorPermissions = require('./get-collaborator-permissions')
+        const token = await getToken()
+        const permission = await getCollaboratorPermissions(context, token, owner, repo, login)
+        return ['ADMIN', 'MAINTAIN', 'WRITE'].includes(permission.toString())
+    }
+
+    if (!await isAllowed(sender)) throw new Error(`${sender} is not allowed to do that`)
+
+    const { searchIssues } = require('./search')
+    const items = await searchIssues(context, 'org:git-for-windows is:pr is:open in:comments "The release-git workflow run was started"')
+
+    const githubApiRequest = require('./github-api-request')
+
+    const needle = `The \`release-git\` workflow run [was started](https://github.com/git-for-windows/git-for-windows-automation/actions/runs/${releaseWorkflowRunID})`
+    const candidates = []
+    for (const item of items) {
+        if (!['OWNER', 'MEMBER'].includes(item.author_association)) continue
+        for (const match of item.text_matches) {
+            const commentURL = match.object_url
+            if (!commentURL.startsWith('https://api.github.com/')) continue
+            const data = await githubApiRequest(context, await getToken(), 'GET', commentURL.substring(22))
+            if (data.body.indexOf(needle) >=0) candidates.push(item)
+        }
+    }
+
+    if (candidates.length !== 1) throw new Error(`Expected 1 candidate PR, got ${candidates.length}`)
+
+    const prNumber = candidates[0].number
+    const pr = await githubApiRequest(context, await getToken(), 'GET', `/repos/${owner}/${repo}/pulls/${prNumber}`)
+    const sha = pr.head.sha
+
+    await githubApiRequest(context, await getToken(), 'PATCH', `/repos/${owner}/${repo}/git/refs/heads/main`, {
+        sha,
+        force: false // require fast-forward
+    })
+
+    return `Took care of pushing the \`main\` branch to close PR ${prNumber}`
+}

GitForWindowsHelper/index.js

@@ -49,6 +49,18 @@ module.exports = async function (context, req) {
         return withStatus(500, undefined, e.message || JSON.stringify(e, null, 2))
     }
 
+    try {
+        const finalizeGitForWindowsRelease = require('./finalize-g4w-release')
+        if (req.headers['x-github-event'] === 'workflow_run'
+            && req.body.repository.full_name === 'git-for-windows/git-for-windows-automation'
+            && req.body.action === 'completed'
+            && req.body.workflow_run.path === '.github/workflows/release-git.yml'
+            && req.body.workflow_run.conclusion === 'success') return ok(await finalizeGitForWindowsRelease(context, req))
+    } catch (e) {
+        context.log(e)
+        return withStatus(500, undefined, e.message || JSON.stringify(e, null, 2))
+    }
+
     try {
         const { cascadingRuns } = require('./cascading-runs.js')
         if (req.headers['x-github-event'] === 'check_run'

__tests__/index.test.js

@@ -67,6 +67,9 @@ let mockGitHubApiRequest = jest.fn((_context, _token, method, requestPath, paylo
         id: 0,
         html_url: `appended-comment-body-${payload.body}`
     }
+    if (method === 'GET' && requestPath.endsWith('/comments/654321')) return {
+        body: 'The `release-git` workflow run [was started](https://github.com/git-for-windows/git-for-windows-automation/actions/runs/54321)'
+    }
     if (method === 'POST' && requestPath.endsWith('/reactions')) return {
         id: `new-reaction-${payload.content}`
     }
@@ -75,7 +78,7 @@ let mockGitHubApiRequest = jest.fn((_context, _token, method, requestPath, paylo
             data: {
                 repository:{
                     collaborators: {
-                        edges: [{ permission: 'WRITE'}]
+                        edges: [{ permission: 'WRITE' }]
                     }
                 }
             }
@@ -130,6 +133,14 @@ let mockGitHubApiRequest = jest.fn((_context, _token, method, requestPath, paylo
     if (method === 'GET' && requestPath.endsWith('/pulls/4323')) return {
         head: { sha: 'dee501d15' }
     }
+    if (method === 'GET' && requestPath.endsWith('/pulls/765')) return {
+        head: { sha: 'c0ffee1ab7e' }
+    }
+    if (method === 'PATCH' && requestPath.endsWith('/git/refs/heads/main')) {
+        if (payload.sha !== 'c0ffee1ab7e') throw new Error(`Unexpected sha: ${payload.sha}`)
+        if (payload.force !== false) throw new Error(`Unexpected force value: ${payload.force}`)
+        return {}
+    }
     if (method === 'GET' && requestPath === '/search/issues?q=repo:git-for-windows/git+c8edb521bdabec14b07e9142e48cab77a40ba339+type:pr+%22git-artifacts%22') return {
         items: [{
             text_matches: [{
@@ -263,7 +274,16 @@ jest.mock('../GitForWindowsHelper/get-installation-id-for-repo', () => {
     return mockGetInstallationIDForRepo
 })
 
-let mockSearchIssues = jest.fn(() => [])
+let mockSearchIssues = jest.fn((_context, searchTerms) => {
+    if (searchTerms.indexOf('release-git') > 0) return [{
+        number: 765,
+        author_association: 'MEMBER',
+        text_matches: [{
+            object_url: 'https://api.github.com/repos/git-for-windows/git/issues/comments/654321'
+        }]
+    }]
+    return []
+})
 jest.mock('../GitForWindowsHelper/search', () => {
     return {
         searchIssues: mockSearchIssues
@@ -753,3 +773,43 @@ The \`release-git\` workflow run [was started](dispatched-workflow-release-git.y
         git_artifacts_i686_workflow_run_id: "686"
     })
 })
+
+test('a completed `release-git` run updates the `main` branch in git-for-windows/git', async () => {
+    const context = makeContext({
+        action: 'completed',
+        repository: {
+            full_name: 'git-for-windows/git-for-windows-automation'
+        },
+        sender: {
+            login: 'a-member'
+        },
+        workflow_run: {
+            id: 54321,
+            path: '.github/workflows/release-git.yml',
+            conclusion: 'success'
+        }
+    }, {
+        'x-github-event': 'workflow_run'
+    })
+
+    try {
+        expect(await index(context, context.req)).toBeUndefined()
+        expect(context.res).toEqual({
+            body: `Took care of pushing the \`main\` branch to close PR 765`,
+            headers: undefined,
+            status: undefined
+        })
+        expect(mockGitHubApiRequest).toHaveBeenCalledTimes(4)
+        expect(mockGitHubApiRequest.mock.calls[3].slice(1)).toEqual([
+            'installation-access-token',
+            'PATCH',
+            '/repos/git-for-windows/git/git/refs/heads/main', {
+                sha: 'c0ffee1ab7e',
+                force: false
+            }
+        ])
+    } catch (e) {
+        context.log.mock.calls.forEach(e => console.log(e[0]))
+        throw e;
+    }
+})