call-github2gerrit.yaml

---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2026 The Linux Foundation

name: "GitHub2Gerrit"

# yamllint disable-line rule:truthy
on:
  # Submit new Github pull requests to Gerrit
  # When pull request is modified, update Gerrit change
  pull_request_target:
    types: [opened, reopened, edited, synchronize, closed]
    branches:
      - main
      - master

  # Pushes from Gerrit use gerrit_to_platform triggers
  # These use the workflow_dispatch method/invocation
  workflow_dispatch:
    inputs:
      GERRIT_BRANCH:
        description: "Branch that change is against"
        required: false
        type: string
      GERRIT_CHANGE_ID:
        description: "The ID for the change"
        required: false
        type: string
      GERRIT_CHANGE_NUMBER:
        description: "The Gerrit number"
        required: false
        type: string
      GERRIT_CHANGE_URL:
        description: "URL to the change"
        required: false
        type: string
      GERRIT_EVENT_TYPE:
        description: "Gerrit event type"
        required: false
        type: string
      GERRIT_PATCHSET_NUMBER:
        description: "The patch number for the change"
        required: false
        type: string
      GERRIT_PATCHSET_REVISION:
        description: "The revision sha"
        required: false
        type: string
      GERRIT_PROJECT:
        description: "Project in Gerrit"
        required: false
        type: string
      GERRIT_REFSPEC:
        description: "Gerrit refspec of change"
        required: false
        type: string
      GERRIT_DISABLED:
        description: "Run without Gerrit components"
        required: false
        default: false
        type: boolean
      allow_duplicates:
        description: "Allow submitting duplicate changes without error"
        required: false
        default: true
        type: boolean
      preserve_github_prs:
        description: "Do not close GitHub PRs after pushing to Gerrit"
        required: false
        default: true
        type: boolean

concurrency:
  # Separate concurrency groups for different event types to prevent interference:
  # - PR events: Group by PR number, allow cancellation of older commits
  # - Push events: Group by run_id (unique), never cancel
  # - Workflow dispatch: Group by run_id (unique), never cancel
  group: >-
    ${{
      github.event_name == 'pull_request_target'
      && format('{0}-pr-{1}', github.workflow,
                github.event.pull_request.number)
      || format('{0}-{1}-{2}', github.workflow, github.event_name,
                github.run_id)
    }}
  # Only cancel in-progress runs for PR events (newer commit supersedes older)
  # Never cancel push events (each Gerrit merge should process independently)
  cancel-in-progress: ${{ github.event_name == 'pull_request_target' }}

jobs:
  repository-metadata:
    name: "Repository Metadata"
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    timeout-minutes: 5
    steps:
      # yamllint disable-line rule:line-length
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      # yamllint disable-line rule:line-length
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: "Gather repository metadata"
        id: repo-metadata
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/repository-metadata-action@ceabcd987d13d7bfefd2372e01eebb0ddac45956 # v0.2.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_summary: "true"
          files_summary: "true"
          artifact_upload: "true"
          artifact_formats: "json"

  notify:
    if: github.event_name == 'workflow_dispatch' && inputs.GERRIT_DISABLED != true
    runs-on: ubuntu-latest
    steps:
      # Harden the runner used by this workflow
      # yamllint disable-line rule:line-length
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Notify job start
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/gerrit-review-action@91db81bb09f604bb620810640c045eeb1f6a9e54 # v1.1.0
        with:
          host: ${{ vars.GERRIT_SERVER }}
          username: ${{ vars.GERRIT_SSH_USER }}
          key: ${{ secrets.GERRIT_SSH_PRIVKEY }}
          known_hosts: ${{ vars.GERRIT_KNOWN_HOSTS }}
          gerrit-change-number: ${{ inputs.GERRIT_CHANGE_NUMBER }}
          gerrit-patchset-number: ${{ inputs.GERRIT_PATCHSET_NUMBER }}
          vote-type: clear
      - name: Allow replication
        run: sleep 10s

  github2gerrit:
    name: "GitHub2Gerrit"
    runs-on: ubuntu-latest
    if: always()
    needs: [notify]
    permissions:
      contents: read
      pull-requests: write
      issues: write
    timeout-minutes: 12
    steps:
      # Harden the runner used by this workflow
      # yamllint disable-line rule:line-length
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        name: "Harden runner"
        with:
          egress-policy: audit

      - name: "Checkout repository"
        # yamllint disable-line rule:line-length
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 10
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: "Run GitHub2Gerrit"
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/github2gerrit-action@a6534e68f2060d685f7b16160a4b44ebf86ef9e5 # v1.2.1
        env:
          # Pass GERRIT_* inputs as environment variables when dispatched from Gerrit
          GERRIT_BRANCH: ${{ github.event.inputs.GERRIT_BRANCH || '' }}
          GERRIT_CHANGE_ID: ${{ github.event.inputs.GERRIT_CHANGE_ID || '' }}
          GERRIT_CHANGE_NUMBER: ${{ github.event.inputs.GERRIT_CHANGE_NUMBER || '' }}
          GERRIT_CHANGE_URL: ${{ github.event.inputs.GERRIT_CHANGE_URL || '' }}
          GERRIT_EVENT_TYPE: ${{ github.event.inputs.GERRIT_EVENT_TYPE || '' }}
          GERRIT_PATCHSET_NUMBER: ${{ github.event.inputs.GERRIT_PATCHSET_NUMBER || '' }}
          GERRIT_PATCHSET_REVISION: ${{ github.event.inputs.GERRIT_PATCHSET_REVISION || '' }}
          GERRIT_PROJECT: ${{ github.event.inputs.GERRIT_PROJECT || '' }}
          GERRIT_REFSPEC: ${{ github.event.inputs.GERRIT_REFSPEC || '' }}
        with:
          # Only for testing in LF Gerrit/sandbox; remove AUTOMATION_ONLY from production workflows
          AUTOMATION_ONLY: "false"
          USE_LOCAL_ACTION: true # Use branch code for testing, not PyPI
          USE_PR_AS_COMMIT: true
          VERBOSE: false

          # Workflow-specific inputs (only used for pull_request_target/workflow_dispatch)
          ALLOW_DUPLICATES: ${{ github.event_name == 'workflow_dispatch' && inputs.allow_duplicates || true }}
          PRESERVE_GITHUB_PRS: ${{ github.event_name == 'workflow_dispatch' && inputs.preserve_github_prs || true }}
          ISSUE_ID_LOOKUP_JSON: ${{ vars.ISSUE_ID_LOOKUP_JSON }}

          # Authentication (required for all contexts)
          GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
          GERRIT_KNOWN_HOSTS: ${{ vars.GERRIT_KNOWN_HOSTS }}

  report-status:
    if: ${{ always() && github.event_name == 'workflow_dispatch' && inputs.GERRIT_DISABLED != true }}
    needs: [notify, github2gerrit]
    runs-on: ubuntu-latest
    steps:
      # Harden the runner used by this workflow
      # yamllint disable-line rule:line-length
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Get workflow conclusion
        uses: im-open/workflow-conclusion@7b146947e59eaf7fc3328822357861ab1758c088 # v2.2.5

      - name: Report workflow conclusion
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/gerrit-review-action@91db81bb09f604bb620810640c045eeb1f6a9e54 # v1.1.0
        with:
          host: ${{ vars.GERRIT_SERVER }}
          username: ${{ vars.GERRIT_SSH_USER }}
          key: ${{ secrets.GERRIT_SSH_PRIVKEY }}
          known_hosts: ${{ vars.GERRIT_KNOWN_HOSTS }}
          gerrit-change-number: ${{ inputs.GERRIT_CHANGE_NUMBER }}
          gerrit-patchset-number: ${{ inputs.GERRIT_PATCHSET_NUMBER }}
          vote-type: ${{ env.WORKFLOW_CONCLUSION }}