release-finalize.yml

# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Triggers automatically when the changelog PR is merged to a candidate branch.
# Records the last-release-sha for Release Please and renames the branch to release/v{version}.
name: "Release: Finalize"

on:
  pull_request:
    types: [closed]
    branches:
      - release/candidate
      - release/v1-candidate

permissions:
  contents: write
  pull-requests: write

jobs:
  finalize:
    if: github.event.pull_request.merged == true && github.repository == 'google/adk-python'
    runs-on: ubuntu-latest
    steps:
      - name: Check for release-please PR
        id: check
        env:
          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
        run: |
          if echo "$LABELS" | grep -q "autorelease: pending"; then
            echo "is_release_pr=true" >> $GITHUB_OUTPUT
          else
            echo "Not a release-please PR, skipping"
            echo "is_release_pr=false" >> $GITHUB_OUTPUT
          fi

      - name: Determine Branch Configurations
        if: steps.check.outputs.is_release_pr == 'true'
        id: config
        env:
          CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: |
          if [ "$CANDIDATE_BRANCH" = "release/v1-candidate" ]; then
            echo "base_branch=v1" >> $GITHUB_OUTPUT
            echo "config_file=.github/release-please-config-v1.json" >> $GITHUB_OUTPUT
            echo "manifest_file=.github/.release-please-manifest-v1.json" >> $GITHUB_OUTPUT
          else
            echo "base_branch=main" >> $GITHUB_OUTPUT
            echo "config_file=.github/release-please-config.json" >> $GITHUB_OUTPUT
            echo "manifest_file=.github/.release-please-manifest.json" >> $GITHUB_OUTPUT
          fi

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        if: steps.check.outputs.is_release_pr == 'true'
        with:
          ref: ${{ github.event.pull_request.base.ref }}
          token: ${{ secrets.RELEASE_PAT }}
          fetch-depth: 0

      - name: Extract version from manifest
        if: steps.check.outputs.is_release_pr == 'true'
        id: version
        env:
          MANIFEST_FILE: ${{ steps.config.outputs.manifest_file }}
        run: |
          VERSION=$(jq -r '.["."]' "$MANIFEST_FILE")
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Extracted version: $VERSION"

      - name: Configure git identity from RELEASE_PAT
        if: steps.check.outputs.is_release_pr == 'true'
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
        run: |
          USER_JSON=$(gh api user)
          git config user.name "$(echo "$USER_JSON" | jq -r '.login')"
          git config user.email "$(echo "$USER_JSON" | jq -r '.id')+$(echo "$USER_JSON" | jq -r '.login')@users.noreply.github.com"

      - name: Record last-release-sha for release-please
        if: steps.check.outputs.is_release_pr == 'true'
        env:
          BASE_BRANCH: ${{ steps.config.outputs.base_branch }}
          CONFIG_FILE: ${{ steps.config.outputs.config_file }}
          CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: |

          git fetch origin "$BASE_BRANCH"
          CUT_SHA=$(git merge-base "origin/$BASE_BRANCH" HEAD)
          echo "Release was cut from $BASE_BRANCH at: $CUT_SHA"

          HAVE_SHA=$(jq -r '."last-release-sha" // ""' "$CONFIG_FILE")
          if [ "$HAVE_SHA" = "$CUT_SHA" ]; then
            echo "last-release-sha is already $CUT_SHA"
            exit 0
          fi

          jq --arg sha "$CUT_SHA" '. + {"last-release-sha": $sha}' \
            "$CONFIG_FILE" > tmp.json
          mv tmp.json "$CONFIG_FILE"

          git add "$CONFIG_FILE"
          git commit -m "chore: update last-release-sha for next $BASE_BRANCH release"
          git push origin "$CANDIDATE_BRANCH"

      - name: Rename candidate to release/v{version}
        if: steps.check.outputs.is_release_pr == 'true'
        env:
          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
          CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: |
          VERSION="v${STEPS_VERSION_OUTPUTS_VERSION}"
          git push origin "$CANDIDATE_BRANCH:refs/heads/release/$VERSION" ":$CANDIDATE_BRANCH"
          echo "Renamed $CANDIDATE_BRANCH to release/$VERSION"

      - name: Update PR label to tagged
        if: steps.check.outputs.is_release_pr == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh pr edit ${{ github.event.pull_request.number }} \
            --remove-label "autorelease: pending" \
            --add-label "autorelease: tagged"
          echo "Updated PR label to autorelease: tagged"