From 7f347e54dfc8858adabdcf366aed6a4ceb35843f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Em=C3=ADdio=20Neto?=
 <9735060+emdneto@users.noreply.github.com>
Date: Thu, 24 Apr 2025 14:31:08 -0300
Subject: [PATCH] infra: Automate SHA procedure during releases (#3424)

---
 .github/workflows/backport.yml                         |  3 ++-
 .../src/generate_workflows_lib/lint.yml.j2             | 10 +++++++++-
 .../src/generate_workflows_lib/misc.yml.j2             | 10 +++++++++-
 .../src/generate_workflows_lib/test.yml.j2             | 10 +++++++++-
 .github/workflows/lint_0.yml                           | 10 +++++++++-
 .github/workflows/misc_0.yml                           | 10 +++++++++-
 .github/workflows/package-prepare-patch-release.yml    |  3 ++-
 .github/workflows/package-prepare-release.yml          |  6 ++++--
 .github/workflows/prepare-patch-release.yml            |  3 ++-
 .github/workflows/prepare-release-branch.yml           |  6 ++++--
 .github/workflows/test_0.yml                           | 10 +++++++++-
 .github/workflows/test_1.yml                           | 10 +++++++++-
 .github/workflows/test_2.yml                           | 10 +++++++++-
 13 files changed, 86 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 26789093f..05488ecca 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -40,4 +40,5 @@ jobs:
           gh pr create --title "[$GITHUB_REF_NAME] $title" \
                        --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
                        --head $branch \
-                       --base $GITHUB_REF_NAME
+                       --base $GITHUB_REF_NAME \
+                       --label backport
diff --git a/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/lint.yml.j2 b/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/lint.yml.j2
index 2cd74daca..a7a806b80 100644
--- a/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/lint.yml.j2
+++ b/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/lint.yml.j2
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: {% raw %}${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}{% endraw %}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w
 
diff --git a/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/misc.yml.j2 b/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/misc.yml.j2
index ea60eb208..56508d2be 100644
--- a/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/misc.yml.j2
+++ b/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/misc.yml.j2
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: {% raw %}${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}{% endraw %}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w
 
diff --git a/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/test.yml.j2 b/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/test.yml.j2
index c55b795e2..c6463889e 100644
--- a/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/test.yml.j2
+++ b/.github/workflows/generate_workflows_lib/src/generate_workflows_lib/test.yml.j2
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: {% raw %}${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}{% endraw %}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w
 
diff --git a/.github/workflows/lint_0.yml b/.github/workflows/lint_0.yml
index a81346ab8..630a25c81 100644
--- a/.github/workflows/lint_0.yml
+++ b/.github/workflows/lint_0.yml
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w
 
diff --git a/.github/workflows/misc_0.yml b/.github/workflows/misc_0.yml
index ca8d102a3..5221d1d5c 100644
--- a/.github/workflows/misc_0.yml
+++ b/.github/workflows/misc_0.yml
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w
 
diff --git a/.github/workflows/package-prepare-patch-release.yml b/.github/workflows/package-prepare-patch-release.yml
index f216eada8..b540cf44c 100644
--- a/.github/workflows/package-prepare-patch-release.yml
+++ b/.github/workflows/package-prepare-patch-release.yml
@@ -118,4 +118,5 @@ jobs:
           gh pr create --title "[$GITHUB_REF_NAME] $message" \
                        --body "$message." \
                        --head $branch \
-                       --base $GITHUB_REF_NAME
+                       --base $GITHUB_REF_NAME \
+                       --label prepare-release
diff --git a/.github/workflows/package-prepare-release.yml b/.github/workflows/package-prepare-release.yml
index d596c4c74..30c922d1e 100644
--- a/.github/workflows/package-prepare-release.yml
+++ b/.github/workflows/package-prepare-release.yml
@@ -142,7 +142,8 @@ jobs:
           gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
                        --body "$message." \
                        --head $branch \
-                       --base $RELEASE_BRANCH_NAME
+                       --base $RELEASE_BRANCH_NAME \
+                       --label prepare-release
 
   create-pull-request-against-main:
     runs-on: ubuntu-latest
@@ -195,4 +196,5 @@ jobs:
           gh pr create --title "$message" \
                        --body "$body" \
                        --head $branch \
-                       --base main
+                       --base main \
+                       --label prepare-release
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 51e1dd820..17d72e4cb 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -83,4 +83,5 @@ jobs:
           gh pr create --title "[$GITHUB_REF_NAME] $message" \
                        --body "$message." \
                        --head $branch \
-                       --base $GITHUB_REF_NAME
+                       --base $GITHUB_REF_NAME \
+                       --label prepare-release
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 6818772ac..01689eae7 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -106,7 +106,8 @@ jobs:
           gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
                        --body "$message." \
                        --head $branch \
-                       --base $RELEASE_BRANCH_NAME
+                       --base $RELEASE_BRANCH_NAME \
+                       --label prepare-release
 
   create-pull-request-against-main:
     runs-on: ubuntu-latest
@@ -192,4 +193,5 @@ jobs:
           gh pr create --title "$message" \
                        --body "$body" \
                        --head $branch \
-                       --base main
+                       --base main \
+                       --label prepare-release
diff --git a/.github/workflows/test_0.yml b/.github/workflows/test_0.yml
index 27e7854d1..2d28e24d8 100644
--- a/.github/workflows/test_0.yml
+++ b/.github/workflows/test_0.yml
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w
 
diff --git a/.github/workflows/test_1.yml b/.github/workflows/test_1.yml
index c3492160d..889755588 100644
--- a/.github/workflows/test_1.yml
+++ b/.github/workflows/test_1.yml
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w
 
diff --git a/.github/workflows/test_2.yml b/.github/workflows/test_2.yml
index 9752857ea..ec25f65f1 100644
--- a/.github/workflows/test_2.yml
+++ b/.github/workflows/test_2.yml
@@ -14,7 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  CORE_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the core repo.
+  CORE_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}
   CONTRIB_REPO_SHA: main
   PIP_EXISTS_ACTION: w