(ELI-466) first draft

Author: TOEL2

.github/workflows/cicd-4-preprod-deploy.yml

@@ -5,29 +5,118 @@ concurrency:
   cancel-in-progress: false
 
 on:
+  # Auto promote after TEST succeeds
+  workflow_run:
+    workflows: ["3. CD | Deploy to Test"]
+    types: [completed]
+
+  # Manual override path (kept)
   workflow_dispatch:
     inputs:
       ref:
         description: "Branch/Tag/SHA to deploy to preprod (dev tag)"
-        required: true
-        default: "main"
+        required: false
+        default: ""
       release_type:
-        description: "Version bump type (use 'rc' to keep the same base and just increment RC)"
-        required: true
-        default: "rc"
+        description: "Version bump (rc|patch|minor|major)"
+        required: false
+        default: ""
         type: choice
-        options:
-          - rc
-          - patch
-          - minor
-          - major
+        options: [rc, patch, minor, major]
 
 jobs:
+  metadata:
+    name: "Resolve ref + release_type"
+    runs-on: ubuntu-latest
+
+    # Only run automatically if TEST succeeded,
+    # or always if this is a manual dispatch
+    if: >
+      (github.event_name == 'workflow_run' &&
+       github.event.workflow_run.conclusion == 'success')
+      || github.event_name == 'workflow_dispatch'
+
+    outputs:
+      ref: ${{ steps.resolve_ref.outputs.ref }}
+      release_type: ${{ steps.resolve_release_type.outputs.release_type }}
+
+    steps:
+      - name: "Checkout exact commit (auto path) or repo (manual path)"
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || 'main' }}
+          fetch-depth: 0
+
+      - name: "Resolve the dev-* tag for this commit (auto path)"
+        id: resolve_ref
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            # manual override provided?
+            if [[ -n "${{ github.event.inputs.ref }}" ]]; then
+              echo "ref=${{ github.event.inputs.ref }}" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+            echo "No manual ref provided; attempting to derive from HEAD of default branch."
+            SHA=$(git rev-parse HEAD)
+          else
+            SHA="${{ github.event.workflow_run.head_sha }}"
+          fi
+
+          git fetch --tags --force
+          TAG=$(git tag --points-at "$SHA" | grep '^dev-' | head -n1 || true)
+          if [[ -z "$TAG" ]]; then
+            echo "ERROR: No dev-* tag found on $SHA=$SHA and no manual ref provided." >&2
+            exit 1
+          fi
+          echo "ref=$TAG" >> $GITHUB_OUTPUT
+          echo "Resolved ref: $TAG"
+
+      - name: "Infer release_type from PR labels (fallback to rc)"
+        id: resolve_release_type
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # manual override wins
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ github.event.inputs.release_type }}" ]]; then
+            echo "release_type=${{ github.event.inputs.release_type }}" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          # find PR for the commit that went to TEST
+          if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
+            SHA="${{ github.event.workflow_run.head_sha }}"
+          else
+            SHA=$(git rev-parse HEAD)
+          fi
+
+          # Use the commits->pulls API to get the PR number
+          PR_NUM=$(gh api \
+            -H "Accept: application/vnd.github.groot-preview+json" \
+            /repos/${{ github.repository }}/commits/$SHA/pulls \
+            --jq '.[0].number // empty')
+
+          RELEASE_TYPE="rc"  # safe default
+          if [[ -n "$PR_NUM" ]]; then
+            LABELS=$(gh api /repos/${{ github.repository }}/issues/$PR_NUM/labels --jq '.[].name')
+            if echo "$LABELS" | grep -q '^release:major$'; then RELEASE_TYPE="major"; fi
+            if echo "$LABELS" | grep -q '^release:minor$'; then RELEASE_TYPE="minor"; fi
+            if echo "$LABELS" | grep -q '^release:patch$'; then RELEASE_TYPE="patch"; fi
+            if echo "$LABELS" | grep -q '^release:rc$';    then RELEASE_TYPE="rc";    fi
+          fi
+
+          echo "release_type=$RELEASE_TYPE" >> $GITHUB_OUTPUT
+          echo "Resolved release_type: $RELEASE_TYPE"
+
   call:
+    needs: [metadata]
     uses: ./.github/workflows/base-deploy.yml
     with:
       environment: preprod
-      ref: ${{ inputs.ref }}
-      release_type: ${{ inputs.release_type }}
+      ref: ${{ needs.metadata.outputs.ref }}
+      release_type: ${{ needs.metadata.outputs.release_type }}
     secrets: inherit
-