fix(ci): trigger fastlane on merged main PRs

Run the Linux amd64 fast-lane after a PR is merged to main, while leaving unmerged PRs as no-ops.

Co-authored-by: JustMe <mr.toing@outlook.com>

ci/main-fastlane.py

@@ -35,6 +35,9 @@ IGNORED_PARTS = {".git", ".release", "artifacts", "bin", "obj", "TestResults", "
 
 def read_changed_files() -> list[str]:
     raw = os.environ.get("CI_PIPELINE_FILES")
+    if os.environ.get("FASTLANE_FILES_FROM_PR_API") == "true":
+        value = json.loads(raw or "[]")
+        return [str(path).replace("\\", "/") for path in value]
     if raw:
         try:
             value = json.loads(raw)

ci/release-linux.sh

@@ -12,8 +12,9 @@ if [[ -n "$tag" ]]; then
   }
   version="${tag#v}"
 else
-  [[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main ]] || {
-    echo "untagged image builds are restricted to pushes on main" >&2
+  [[ ("${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main) || \
+     ("${CI_PIPELINE_EVENT:-}" == pull_request_closed && "${CI_COMMIT_BRANCH:-}" == main && "${FASTLANE_MERGED_PR:-}" == true) ]] || {
+    echo "untagged image builds are restricted to main pushes and merged PRs" >&2
     exit 2
   }
   version=main

ci/release-main-images.sh

@@ -2,15 +2,6 @@
 # Build and push only the linux/amd64 OCI images affected by a main push.
 set -euo pipefail
 
-[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main ]] || {
-  echo "fast-lane images can only be published from a push to main" >&2
-  exit 2
-}
-[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
-  echo "Zot credentials are required" >&2
-  exit 2
-}
-
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 registry="${ZOT_REGISTRY:-registry.oeo.one}"
 work="$root/.release/main-fastlane"
@@ -20,6 +11,38 @@ export HOME="$buildah_home"
 export BUILDAH_HOME="$buildah_home"
 export REGISTRY_AUTH_FILE="$work/zot-auth.json"
 
+if [[ "${CI_PIPELINE_EVENT:-}" == pull_request_closed ]]; then
+  [[ "${CI_COMMIT_TARGET_BRANCH:-}" == main && -n "${CI_COMMIT_PULL_REQUEST:-}" ]] || {
+    echo "ignoring closed pull request outside main" >&2
+    exit 0
+  }
+  gitea_base="${GITEA_BASE:-http://127.0.0.1:3100}"
+  api="$gitea_base/api/v1/repos/justme/MyMonitor"
+  pr_json="$(curl --fail-with-body --silent --show-error "$api/pulls/$CI_COMMIT_PULL_REQUEST")"
+  read -r merged base_branch <<< "$(python3 -c 'import json,sys; p=json.load(sys.stdin); print(str(p.get("merged", False)).lower(), p.get("base", {}).get("ref", ""))' <<< "$pr_json")"
+  if [[ "$merged" != true || "$base_branch" != main ]]; then
+    echo "pull request $CI_COMMIT_PULL_REQUEST was closed without merging to main; skipping images"
+    exit 0
+  fi
+
+  export FASTLANE_MERGED_PR=true
+  export FASTLANE_FILES_FROM_PR_API=true
+  export CI_PIPELINE_FILES="$(curl --fail-with-body --silent --show-error \
+    "$api/pulls/$CI_COMMIT_PULL_REQUEST/files?limit=500" \
+    | python3 -c 'import json,sys; print(json.dumps([name for item in json.load(sys.stdin) for name in (item["filename"], item.get("previous_filename")) if name]))')"
+  git fetch "$gitea_base/justme/MyMonitor.git" main
+  git checkout --detach FETCH_HEAD
+  export CI_COMMIT_BRANCH=main
+elif [[ "${CI_PIPELINE_EVENT:-}" != push || "${CI_COMMIT_BRANCH:-}" != main ]]; then
+  echo "fast-lane images can only be published from a main push or a merged PR into main" >&2
+  exit 2
+fi
+
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+  echo "Zot credentials are required" >&2
+  exit 2
+}
+
 targets="$(python3 "$root/ci/main-fastlane.py")"
 if [[ -z "$targets" ]]; then
   echo "no runtime image changes detected; skipping container builds"