auto-sync-master-with-develop.yml

name: 'Auto Sync `master` with `develop`'

on:
  push:
    branches:
      - develop

permissions:
  contents: write

jobs:
  sync-branches:
    # Trigger if ANY commit in the push (not just the head commit) starts with
    # `[RELEASE]`. Previously this only checked `head_commit.message`, which
    # silently skipped merge-commit-style PRs whose subject is the auto-generated
    # `Merge pull request #NNNN from …` — the `[RELEASE]`-tagged commit lived
    # one level deeper in the merge tree and never reached master.
    if: contains(toJson(github.event.commits.*.message), '[RELEASE]')

    runs-on: ubuntu-latest

    steps:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.AUTO_SYNC_BRANCHES_APP_ID }}
          private-key: ${{ secrets.AUTO_SYNC_BRANCHES_SECRET }}

      - name: Checkout Master
        uses: actions/checkout@v4
        with:
          ref: master
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Merge Release Commit to Master
        # Use a real merge (not --ff-only). master legitimately diverges from
        # develop whenever a develop→master promotion is merged as a PR (which
        # adds a merge/squash commit to master that isn't on develop), and
        # --ff-only then fails permanently on every subsequent release. A no-ff
        # merge always succeeds (non-destructive — master keeps its own commits,
        # develop's release commits come in) and still changes CHANGELOG.md so
        # release-dapps deploys.
        run: |
          git fetch origin develop
          git merge --no-ff -m "chore(release): sync develop into master (${{ github.sha }})" ${{ github.sha }}

      - name: Push Changes to Master
        run: git push origin master
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}