auto-release.yaml

name: Auto Release

on:
  push:
    branches: [main]
    paths-ignore:
      - "CHANGELOG.md"
      - "docs/observability.md"
      - "README.md"
  workflow_dispatch:

concurrency:
  group: auto-release-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  packages: write
  pull-requests: write

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || !contains(github.event.head_commit.message, '[skip ci]')
    outputs:
      should_release: ${{ steps.check.outputs.should_release }}
      next_version: ${{ steps.check.outputs.next_version }}
      latest_tag: ${{ steps.check.outputs.latest_tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine version bump
        id: check
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          HEAD_COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          set -euo pipefail
          LATEST_TAG=$(git tag --sort=-version:refname | grep -E '^v[0-9]' | head -1 || echo "v0.0.0")
          LATEST_VERSION="${LATEST_TAG#v}"
          CHART_VERSION="$(awk -F: '/^version:/ {v=$2; gsub(/[ "]/, "", v); print v; exit}' charts/loki-vl-proxy/Chart.yaml)"
          echo "latest_tag=${LATEST_TAG}" >> "$GITHUB_OUTPUT"
          echo "Latest tag: $LATEST_TAG"

          COMMITS=$(git log "${LATEST_TAG}..HEAD" --pretty=format:"%s" 2>/dev/null || git log --pretty=format:"%s")
          FILES_CHANGED=$(git diff --name-only "${LATEST_TAG}..HEAD" 2>/dev/null || git diff --name-only HEAD~1)

          if echo "${HEAD_COMMIT_MSG:-}" | grep -qE '^docs: sync release metadata for v[0-9]'; then
            echo "should_release=false" >> "$GITHUB_OUTPUT"
            echo "Skipping metadata sync commit"
            exit 0
          fi

          DOCS_OR_CI_ONLY="yes"
          while IFS= read -r file; do
            [ -z "$file" ] && continue
            if ! echo "$file" | grep -Eq '^(README\.md|CHANGELOG\.md|docs/|\.github/)$'; then
              DOCS_OR_CI_ONLY="no"
              break
            fi
          done <<< "$FILES_CHANGED"

          if [ "$DOCS_OR_CI_ONLY" = "yes" ]; then
            echo "should_release=false" >> "$GITHUB_OUTPUT"
            echo "Only docs/ci/metadata files changed; skipping release"
            exit 0
          fi

          if echo "${CHART_VERSION}" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            MAX_VERSION="$(printf '%s\n%s\n' "${LATEST_VERSION}" "${CHART_VERSION}" | sort -V | tail -1)"
            if [ "${MAX_VERSION}" = "${CHART_VERSION}" ] && [ "${CHART_VERSION}" != "${LATEST_VERSION}" ]; then
              echo "should_release=true" >> "$GITHUB_OUTPUT"
              echo "next_version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
              echo "Chart version override detected: ${CHART_VERSION} (latest tag is ${LATEST_VERSION})"
              exit 0
            fi
          fi

          BUMP="none"
          PR_LABELS=""
          PR_LABELS_LOWER=""
          PR_TITLE=""
          PR_CHANGED_FILES=0
          PR_ADDITIONS=0
          PR_DELETIONS=0
          PR_TOTAL_CHURN=0
          PR_NUMBER="$(echo "${HEAD_COMMIT_MSG:-}" | grep -oE '#[0-9]+' | tail -1 | tr -d '#' || true)"

          if [ -n "${PR_NUMBER}" ]; then
            PR_JSON="$(curl -fsSL \
              -H "Authorization: Bearer ${GH_TOKEN}" \
              -H "Accept: application/vnd.github+json" \
              "https://api.github.com/repos/${REPO}/pulls/${PR_NUMBER}" || true)"
            if [ -n "$PR_JSON" ]; then
              PR_LABELS="$(echo "$PR_JSON" | jq -r '.labels[]?.name' || true)"
              PR_LABELS_LOWER="$(echo "$PR_LABELS" | tr '[:upper:]' '[:lower:]')"
              PR_TITLE="$(echo "$PR_JSON" | jq -r '.title // ""' || true)"
              PR_CHANGED_FILES="$(echo "$PR_JSON" | jq -r '.changed_files // 0' || echo 0)"
              PR_ADDITIONS="$(echo "$PR_JSON" | jq -r '.additions // 0' || echo 0)"
              PR_DELETIONS="$(echo "$PR_JSON" | jq -r '.deletions // 0' || echo 0)"
              PR_TOTAL_CHURN=$((PR_ADDITIONS + PR_DELETIONS))
              echo "PR #${PR_NUMBER} labels: ${PR_LABELS:-<none>}"
              echo "PR #${PR_NUMBER} title: ${PR_TITLE:-<none>}"
              echo "PR #${PR_NUMBER} changed_files=${PR_CHANGED_FILES} additions=${PR_ADDITIONS} deletions=${PR_DELETIONS} churn=${PR_TOTAL_CHURN}"

              if echo "$PR_LABELS_LOWER" | grep -qE '^no-release$'; then
                echo "should_release=false" >> "$GITHUB_OUTPUT"
                echo "PR has no-release label; skipping release"
                exit 0
              fi

              if echo "$PR_LABELS_LOWER" | grep -qE '^release:major$'; then
                BUMP="major"
              elif echo "$PR_LABELS_LOWER" | grep -qE '^release:minor$'; then
                BUMP="minor"
              elif echo "$PR_LABELS_LOWER" | grep -qE '^release:patch$'; then
                BUMP="patch"
              elif echo "$PR_LABELS_LOWER" | grep -qE '^(breaking-change)$'; then
                BUMP="major"
              elif echo "$PR_LABELS_LOWER" | grep -qE '^(feature)$'; then
                BUMP="minor"
              elif echo "$PR_LABELS_LOWER" | grep -qE '^(bugfix|performance)$'; then
                BUMP="patch"
              fi

              # Size- and scope-aware automatic promotion:
              # large runtime-impacting PRs should bump at least minor.
              if [ "$BUMP" != "major" ]; then
                XL_SIZE="false"
                RUNTIME_SCOPE="false"
                LARGE_DIFF="false"

                if echo "$PR_LABELS_LOWER" | grep -qE '^size/(xl|xxl)$'; then
                  XL_SIZE="true"
                fi

                if echo "$PR_LABELS_LOWER" | grep -qE '^scope/(proxy|cache|translator|cli|helm|api)$'; then
                  RUNTIME_SCOPE="true"
                fi

                if [ "${PR_CHANGED_FILES}" -ge 20 ] || [ "${PR_TOTAL_CHURN}" -ge 1200 ]; then
                  LARGE_DIFF="true"
                fi

                if { [ "${XL_SIZE}" = "true" ] && [ "${RUNTIME_SCOPE}" = "true" ]; } || [ "${LARGE_DIFF}" = "true" ]; then
                  if [ "$BUMP" = "none" ] || [ "$BUMP" = "patch" ]; then
                    BUMP="minor"
                    echo "Auto-promoted bump to minor based on PR size/scope heuristic"
                  fi
                fi
              fi
            fi
          fi

          if [ "$BUMP" = "none" ]; then
            if echo "$COMMITS" | grep -qE 'BREAKING CHANGE|^feat.*!:|^fix.*!:'; then
              BUMP="major"
            elif echo "$COMMITS" | grep -qE '^feat(\(|:)'; then
              BUMP="minor"
            elif echo "$COMMITS" | grep -qE '^(fix|perf|refactor|revert)(\(|:)'; then
              BUMP="patch"
            fi
          fi

          if [ "$BUMP" = "none" ]; then
            BUMP="patch"
            echo "No explicit release signal found; defaulting to patch bump for non-doc/ci changes"
          fi

          CURRENT="${LATEST_TAG#v}"
          IFS='.' read -r MAJ MIN PAT <<< "$CURRENT"
          case "$BUMP" in
            major) MAJ=$((MAJ+1)); MIN=0; PAT=0 ;;
            minor) MIN=$((MIN+1)); PAT=0 ;;
            patch) PAT=$((PAT+1)) ;;
          esac

          echo "should_release=true" >> "$GITHUB_OUTPUT"
          echo "next_version=${MAJ}.${MIN}.${PAT}" >> "$GITHUB_OUTPUT"
          echo "Bump: $BUMP -> v${MAJ}.${MIN}.${PAT}"

  validate-release:
    needs: prepare-release
    if: needs.prepare-release.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    outputs:
      test_count: ${{ steps.metrics.outputs.tests }}
      coverage_pct: ${{ steps.metrics.outputs.coverage_pct }}
      code_lines: ${{ steps.metrics.outputs.code_lines }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.2"
          cache: true

      - name: Install Helm
        uses: azure/setup-helm@v4

      - name: Verify unreleased changelog section exists
        run: |
          set -euo pipefail
          chmod +x scripts/ci/extract_changelog_section.sh
          scripts/ci/extract_changelog_section.sh Unreleased CHANGELOG.md > /tmp/release-section.md
          test -s /tmp/release-section.md
          if ! grep -qE '^(### |- )' /tmp/release-section.md; then
            echo "Unreleased changelog section is empty"
            exit 1
          fi

      - name: Run release validation tests
        run: go test ./... -count=1

      - name: Collect validation metrics
        id: metrics
        run: |
          set -euo pipefail
          TESTS=$(go test ./... -count=1 -json 2>/dev/null | jq -r 'select(.Action=="pass" and .Test != null) | .Test' | wc -l | tr -d ' ')
          go test ./... -coverprofile=coverage.out -count=1 >/dev/null 2>&1
          COV=$(go tool cover -func=coverage.out | tail -1 | awk '{print $NF}' | tr -d '%')
          CODE_LINES=$(git ls-files '*.go' | xargs wc -l | tail -1 | awk '{print $1}')
          {
            echo "tests=${TESTS}"
            echo "coverage_pct=${COV}"
            echo "code_lines=${CODE_LINES}"
          } >> "$GITHUB_OUTPUT"

      - name: Helm lint
        run: helm lint charts/loki-vl-proxy/

  publish-release:
    needs: [prepare-release, validate-release]
    if: needs.prepare-release.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    env:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      HAS_RELEASE_PR_TOKEN: ${{ secrets.RELEASE_PR_TOKEN != '' }}
      HAS_GHCR_PACKAGE_ADMIN_TOKEN: ${{ secrets.GHCR_PACKAGE_ADMIN_TOKEN != '' }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_PR_TOKEN != '' && secrets.RELEASE_PR_TOKEN || github.token }}

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.2"
          cache: true

      - name: Install Helm
        uses: azure/setup-helm@v4

      - name: Extract release metadata
        id: meta
        run: |
          set -euo pipefail
          VERSION="${{ needs.prepare-release.outputs.next_version }}"
          TAG="v${VERSION}"
          PREV_TAG="${{ needs.prepare-release.outputs.latest_tag }}"
          chmod +x scripts/ci/extract_changelog_section.sh
          chmod +x scripts/ci/materialize_unreleased.sh
          NOTES_FILE="$(mktemp)"
          SECTION_FILE="$(mktemp)"
          scripts/ci/materialize_unreleased.sh "${VERSION}" "$(date +%Y-%m-%d)" CHANGELOG.md
          scripts/ci/extract_changelog_section.sh "${VERSION}" CHANGELOG.md > "$SECTION_FILE"
          git checkout -- CHANGELOG.md
          cat "$SECTION_FILE" > "$NOTES_FILE"
          {
            echo "tag=${TAG}"
            echo "version=${VERSION}"
            echo "prev_tag=${PREV_TAG}"
            echo "build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
            echo "notes_file=${NOTES_FILE}"
          } >> "$GITHUB_OUTPUT"
      - name: Create release tag
        env:
          RELEASE_PR_TOKEN: ${{ secrets.RELEASE_PR_TOKEN }}
          WORKFLOW_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          TAG="${{ steps.meta.outputs.tag }}"
          PRIMARY_TOKEN="${RELEASE_PR_TOKEN:-$WORKFLOW_TOKEN}"
          PRIMARY_ACTOR="RELEASE_PR_TOKEN"
          if [ -z "${RELEASE_PR_TOKEN:-}" ]; then
            PRIMARY_ACTOR="GITHUB_TOKEN"
          fi
          git fetch --tags origin
          if git rev-parse "${TAG}" >/dev/null 2>&1; then
            echo "Tag ${TAG} already exists"
          else
            git tag "${TAG}" "${GITHUB_SHA}"
            PRIMARY_URL="https://x-access-token:${PRIMARY_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
            if ! git push "${PRIMARY_URL}" "${TAG}"; then
              if [ "${PRIMARY_ACTOR}" = "RELEASE_PR_TOKEN" ]; then
                echo "::warning::Tag push with RELEASE_PR_TOKEN failed; retrying with GITHUB_TOKEN"
                git push "https://x-access-token:${WORKFLOW_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "${TAG}"
              else
                echo "::error::Tag push failed with GITHUB_TOKEN and no RELEASE_PR_TOKEN fallback is available"
                exit 1
              fi
            fi
          fi

      - name: Build release binaries
        run: |
          set -euo pipefail
          VERSION="${{ steps.meta.outputs.version }}"
          if [ -z "${VERSION}" ] || [ "${VERSION}" = "dev" ]; then
            echo "refusing to build release binaries with VERSION='${VERSION}'" >&2
            exit 1
          fi
          REVISION="${GITHUB_SHA}"
          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          mkdir -p dist
          for GOOS_GOARCH in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
            GOOS="${GOOS_GOARCH%/*}"
            GOARCH="${GOOS_GOARCH#*/}"
            OUT="dist/loki-vl-proxy-${GOOS}-${GOARCH}"
            CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" \
              go build -ldflags="-s -w -X main.version=${VERSION} -X main.revision=${REVISION} -X main.buildTime=${BUILD_TIME}" \
              -o "$OUT" ./cmd/proxy
          done
          cd dist && sha256sum loki-vl-proxy-* > checksums.txt

      - name: Package Helm chart
        run: |
          VERSION="${{ steps.meta.outputs.version }}"
          helm package charts/loki-vl-proxy \
            --version "${VERSION}" \
            --app-version "${VERSION}" \
            --destination dist

      - name: Login Helm to GHCR
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io \
            --username "${{ github.actor }}" \
            --password-stdin

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
        uses: docker/login-action@v3
        with:
          registry: docker.io
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Resolve Docker image tags
        id: image-tags
        env:
          VERSION: ${{ steps.meta.outputs.version }}
        run: |
          set -euo pipefail
          OWNER_LC="$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')"
          {
            echo "tags<<EOF"
            echo "ghcr.io/${OWNER_LC}/loki-vl-proxy:${VERSION}"
            if [ -n "${DOCKERHUB_USERNAME}" ] && [ -n "${DOCKERHUB_TOKEN}" ]; then
              echo "docker.io/reliablyobserve/loki-vl-proxy:${VERSION}"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            VERSION=${{ steps.meta.outputs.version }}
            REVISION=${{ github.sha }}
            BUILD_TIME=${{ steps.meta.outputs.build_time }}
          tags: ${{ steps.image-tags.outputs.tags }}
          labels: |
            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}

      - name: Publish Helm chart to GHCR
        run: |
          VERSION="${{ steps.meta.outputs.version }}"
          OWNER_LC="$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')"
          helm push "dist/loki-vl-proxy-${VERSION}.tgz" "oci://ghcr.io/${OWNER_LC}/charts"

      - name: Ensure GHCR Helm chart package is public
        env:
          GH_TOKEN: ${{ secrets.GHCR_PACKAGE_ADMIN_TOKEN }}
        run: |
          set -euo pipefail
          OWNER="${GITHUB_REPOSITORY_OWNER}"
          OWNER_LC="$(echo "${OWNER}" | tr '[:upper:]' '[:lower:]')"
          PKG="charts%2Floki-vl-proxy"
          if [ "${HAS_GHCR_PACKAGE_ADMIN_TOKEN}" != "true" ]; then
            echo "::warning::GHCR_PACKAGE_ADMIN_TOKEN not configured. Helm chart visibility cannot be enforced automatically."
            echo "::warning::Set package visibility to public manually: ghcr.io/${OWNER_LC}/charts/loki-vl-proxy"
            exit 0
          fi
          gh api -X PATCH "/orgs/${OWNER}/packages/container/${PKG}/visibility" -f visibility=public >/dev/null
          echo "Ensured public visibility for ghcr.io/${OWNER_LC}/charts/loki-vl-proxy"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.meta.outputs.tag }}
          name: ${{ steps.meta.outputs.tag }}
          body_path: ${{ steps.meta.outputs.notes_file }}
          files: |
            dist/loki-vl-proxy-linux-*
            dist/loki-vl-proxy-darwin-*
            dist/checksums.txt
            dist/loki-vl-proxy-*.tgz

      - name: Prepare release metadata branch
        id: metadata
        env:
          METADATA_PUSH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN != '' && secrets.RELEASE_PR_TOKEN || github.token }}
          VERSION: ${{ steps.meta.outputs.version }}
          TEST_COUNT: ${{ needs.validate-release.outputs.test_count }}
          COVERAGE_PCT: ${{ needs.validate-release.outputs.coverage_pct }}
          CODE_LINES: ${{ needs.validate-release.outputs.code_lines }}
        run: |
          set -euo pipefail
          if [ "${HAS_RELEASE_PR_TOKEN}" != "true" ]; then
            echo "::warning::RELEASE_PR_TOKEN is not configured. Metadata PRs created by github-actions may not trigger pull_request checks automatically."
          fi
          chmod +x scripts/ci/sync_release_metadata.sh
          scripts/ci/sync_release_metadata.sh "${VERSION}" "$(date +%Y-%m-%d)" "${TEST_COUNT}" "${COVERAGE_PCT}" "${CODE_LINES}" . "${GITHUB_REPOSITORY}"

          CHART_VERSION="$(awk -F: '/^version:/ {v=$2; gsub(/[ "]/, "", v); print v; exit}' charts/loki-vl-proxy/Chart.yaml)"
          CHART_APP_VERSION="$(awk -F: '/^appVersion:/ {v=$2; gsub(/[ "]/, "", v); print v; exit}' charts/loki-vl-proxy/Chart.yaml)"
          if [ "${CHART_VERSION}" != "${VERSION}" ] || [ "${CHART_APP_VERSION}" != "${VERSION}" ]; then
            echo "::error::Chart.yaml version/appVersion mismatch after metadata sync: version=${CHART_VERSION} appVersion=${CHART_APP_VERSION} expected=${VERSION}"
            exit 1
          fi

          if git diff --quiet --exit-code -- CHANGELOG.md README.md docs/observability.md charts/loki-vl-proxy/Chart.yaml; then
            echo "release metadata already synced"
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          BRANCH="release/metadata-v${VERSION}"
          echo "has_changes=true" >> "$GITHUB_OUTPUT"
          echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git checkout -B "${BRANCH}"
          git add -f -- CHANGELOG.md README.md docs/observability.md charts/loki-vl-proxy/Chart.yaml
          git commit -m "docs: sync release metadata for v${VERSION}"
          PUSH_URL="https://x-access-token:${METADATA_PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          if ! git push "${PUSH_URL}" "${BRANCH}" --force; then
            echo "::warning::Unable to push release metadata branch ${BRANCH}. Skipping metadata PR automation for this release."
            echo "::warning::Verify RELEASE_PR_TOKEN permissions (contents:write and pull_requests:write) to re-enable metadata sync automation."
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

      - name: Create or update release metadata PR
        id: metadata-pr
        if: steps.metadata.outputs.has_changes == 'true'
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN != '' && secrets.RELEASE_PR_TOKEN || github.token }}
          VERSION: ${{ steps.meta.outputs.version }}
          BRANCH: ${{ steps.metadata.outputs.branch }}
        run: |
          set -euo pipefail
          TITLE="docs: sync release metadata for v${VERSION}"
          BODY=$'## Summary\n- sync release metadata files for v'"${VERSION}"$' after automated release publish\n- update CHANGELOG materialization, Helm chart version/appVersion, observability service.version, and README release badges\n\n## Why\n- branch protection blocks direct pushes to main\n- this PR preserves required checks and signed merge flow while keeping metadata sync automated'

          PR_NUMBER="$(gh pr list --repo "${GITHUB_REPOSITORY}" --head "${BRANCH}" --base main --state open --json number --jq '.[0].number // empty')"
          if [ -n "${PR_NUMBER}" ]; then
            gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --title "${TITLE}" --body "${BODY}"
          else
            gh pr create \
              --repo "${GITHUB_REPOSITORY}" \
              --base main \
              --head "${BRANCH}" \
              --title "${TITLE}" \
              --body "${BODY}" >/tmp/release-metadata-pr-url.txt
            PR_NUMBER="$(basename "$(cat /tmp/release-metadata-pr-url.txt)")"
          fi
          echo "number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"

      - name: Enable auto-merge for release metadata PR
        if: steps.metadata-pr.outputs.number != ''
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN != '' && secrets.RELEASE_PR_TOKEN || github.token }}
        run: |
          set -euo pipefail
          gh pr merge "${{ steps.metadata-pr.outputs.number }}" \
            --repo "${GITHUB_REPOSITORY}" \
            --auto \
            --squash \
            --delete-branch || true