prowler/.github/workflows/create-backport-label.yml

name: 'Tools: Backport Label'

on:
  release:
    types:
      - 'published'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
  cancel-in-progress: false

env:
  BACKPORT_LABEL_PREFIX: backport-to-
  BACKPORT_LABEL_COLOR: B60205

jobs:
  create-label:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      issues: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Create backport label for minor releases
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          RELEASE_TAG="${GITHUB_EVENT_RELEASE_TAG_NAME}"

          if [ -z "$RELEASE_TAG" ]; then
            echo "Error: No release tag provided"
            exit 1
          fi

          echo "Processing release tag: $RELEASE_TAG"

          # Remove 'v' prefix if present (e.g., v3.2.0 -> 3.2.0)
          VERSION_ONLY="${RELEASE_TAG#v}"

          # Check if it's a minor version (X.Y.0)
          if [[ "$VERSION_ONLY" =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then
            echo "Release $RELEASE_TAG (version $VERSION_ONLY) is a minor version. Proceeding to create backport label."

            # Extract X.Y from X.Y.0 (e.g., 5.6 from 5.6.0)
            MAJOR="${BASH_REMATCH[1]}"
            MINOR="${BASH_REMATCH[2]}"
            TWO_DIGIT_VERSION="${MAJOR}.${MINOR}"

            LABEL_NAME="${BACKPORT_LABEL_PREFIX}v${TWO_DIGIT_VERSION}"
            LABEL_DESC="Backport PR to the v${TWO_DIGIT_VERSION} branch"
            LABEL_COLOR="$BACKPORT_LABEL_COLOR"

            echo "Label name: $LABEL_NAME"
            echo "Label description: $LABEL_DESC"

            # Check if label already exists
            if gh label list --repo ${{ github.repository }} --limit 1000 | grep -q "^${LABEL_NAME}[[:space:]]"; then
              echo "Label '$LABEL_NAME' already exists."
            else
              echo "Label '$LABEL_NAME' does not exist. Creating it..."
              gh label create "$LABEL_NAME" \
                --description "$LABEL_DESC" \
                --color "$LABEL_COLOR" \
                --repo ${{ github.repository }}
              echo "Label '$LABEL_NAME' created successfully."
            fi
          else
            echo "Release $RELEASE_TAG (version $VERSION_ONLY) is not a minor version. Skipping backport label creation."
          fi