cherryPick.yml

name: Cherry-pick a pull request

on:
  workflow_dispatch:
    inputs:
      PULL_REQUEST_URL:
        description: The full URL of the E/App or E/Mobile-Expensify pull request to cherry-pick
        type: string
        required: true
      TARGET:
        description: CP to staging or production?
        required: true
        type: choice
        options:
          - staging
          - production
        default: staging

  workflow_call:
    inputs:
      # Note: this is required for manually-run CP's, but we don't require it for the workflow_call trigger.
      # The reason is that this workflow is only called programmatically after a CP to Prod,
      # and in that case we just want to CP a version bump - no other PR.
      PULL_REQUEST_URL:
        description: The full URL of the E/App or E/Mobile-Expensify pull request to cherry-pick
        type: string
        required: false
      TARGET:
        description: CP to staging or production?
        type: string
        required: true

concurrency:
  group: 'cherrypick'
  cancel-in-progress: false

jobs:
  validate:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Validate pull request URL
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        run: |
          REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')
          if [[ "$REPO_FULL_NAME" != ${{ github.repository }} ]] && [[ ! "$REPO_FULL_NAME" =~ Expensify/Mobile-Expensify* ]]; then
            echo "::error::❌ Cherry picks are only supported for the Expensify/App and Expensify/Mobile-Expensify repositories. Found: $REPO_FULL_NAME"
            exit 1
          fi

      - name: Verify PR is merged
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
        run: |
          if gh pr view "${{ inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt'; then
            echo "PR is merged: ${{ inputs.PULL_REQUEST_URL }}"
          else
            echo "::error::❌ PR is not merged: ${{ inputs.PULL_REQUEST_URL }}"
            exit 1
          fi

  createNewVersion:
    uses: ./.github/workflows/createNewVersion.yml
    secrets: inherit
    needs: [validate]
    with:
      # In order to submit a new build for production review, it must have a higher PATCH version than the previously-submitted build.
      # The typical case is that with each staging deploy, we bump the BUILD version, and with each prod deploy we bump the PATCH version.
      # However, if PULL_REQUEST_URL is empty, we assume we want to do a PATCH version bump.
      # The reason we assume that is because the use-case for a no-PR CP is after a CP to Production.
      # In that case, we need to bump the staging version to be higher than prod.
      # We use a patch version so that there's a diff in both `CFBundleVersion` and `CFBundleShortVersion` on iOS,
      # so that when we later CP that version bump to staging, the `CFBundleShortVersion` diff is picked up as well.
      SEMVER_LEVEL: ${{ (inputs.TARGET == 'production' || inputs.PULL_REQUEST_URL == '') && 'PATCH' || 'BUILD' }}

  cherryPick:
    needs: createNewVersion
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Check for in-progress deploy on target branch
        id: checkInProgressDeploy
        run: |
          # Capture in-progress deploy URL before we push. The actual Slack post is gated on a successful target-branch push.
          DEPLOY_RUN_URL=$(gh api \
            "repos/${{ github.repository }}/actions/workflows/deploy.yml/runs?branch=${{ inputs.TARGET }}&per_page=5" \
            --jq '.workflow_runs[] | select(.status != "completed") | .html_url' | head -n 1)
          echo "DEPLOY_RUN_URL=$DEPLOY_RUN_URL" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Extract PR information
        # Note: this step is only skipped when there's no PULL_REQUEST_URL, which is only ever be the case when we're CPing just a version bump.
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: getPRInfo
        run: |
          echo "REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')" >> "$GITHUB_OUTPUT"
          echo "PR_NUMBER=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|.*/pull/([0-9]+).*|\1|')" >> "$GITHUB_OUTPUT"

      - name: Set conflict branch name
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: getBranchName
        run: echo "CONFLICT_BRANCH_NAME=cherry-pick-${{ inputs.TARGET }}-${{ steps.getPRInfo.outputs.PR_NUMBER }}-${{ github.run_id }}-${{ github.run_attempt }}" >> "$GITHUB_OUTPUT"

      - name: Checkout target branch
        uses: useblacksmith/checkout@0647fdbab2614a5eb86d2971070e325060d91056 # v1.7.0
        with:
          ref: ${{ inputs.TARGET }}
          token: ${{ secrets.OS_BOTIFY_TOKEN }}
          submodules: true

      # This command is necessary to fetch any branch other than main in the submodule.
      # See https://github.com/actions/checkout/issues/1815#issuecomment-2777836442 for further context.
      - name: Enable branch-switching in submodules
        run: |
          git submodule foreach '\
            git config --add remote.origin.fetch "+refs/heads/staging:refs/remotes/origin/staging" && \
            git config --add remote.origin.fetch "+refs/heads/production:refs/remotes/origin/production"'

      - name: Set up git for OSBotify
        id: setupGitForOSBotify
        uses: Expensify/GitHub-Actions/setupGitForOSBotify@main
        with:
          OP_VAULT: ${{ vars.OP_VAULT }}
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          OS_BOTIFY_APP_ID: ${{ secrets.OS_BOTIFY_APP_ID }}
          OS_BOTIFY_PRIVATE_KEY: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }}

      - name: Get previous app version
        id: getPreviousVersion
        uses: ./.github/actions/javascript/getPreviousVersion
        with:
          SEMVER_LEVEL: ${{ inputs.TARGET == 'staging' && 'PATCH' || 'MINOR' }}

      - name: Fetch history of relevant refs
        run: |
          git fetch origin main ${{ inputs.TARGET }} --no-recurse-submodules --no-tags --shallow-exclude ${{ steps.getPreviousVersion.outputs.PREVIOUS_VERSION }}
          cd Mobile-Expensify
          git fetch origin main ${{ inputs.TARGET }} --no-recurse-submodules --no-tags --shallow-exclude ${{ steps.getPreviousVersion.outputs.PREVIOUS_VERSION }}

      - name: Get E/App version bump commit
        id: getVersionBumpCommit
        run: |
          git switch main
          VERSION_BUMP_COMMIT="$(git log -1 --format='%H' --author='OSBotify' --grep 'Update version to ${{ needs.createNewVersion.outputs.NEW_VERSION }}')"
          if [ -z "$VERSION_BUMP_COMMIT" ]; then
            echo "::error::❌ Could not find E/App version bump commit for ${{ needs.createNewVersion.outputs.NEW_VERSION }}"
            echo "::error::This may indicate E/App and Mobile-Expensify versions are out of sync"
            echo "::error::Run the syncVersions workflow to fix, then retry this cherry-pick"
            git log --oneline -20
            exit 1
          fi
          echo "::notice::👀 Found E/App version bump commit $VERSION_BUMP_COMMIT"
          echo "VERSION_BUMP_SHA=$VERSION_BUMP_COMMIT" >> "$GITHUB_OUTPUT"

      - name: Get Mobile-Expensify version bump commit
        id: getMobileExpensifyVersionBumpCommit
        working-directory: Mobile-Expensify
        run: |
          git switch main
          VERSION_BUMP_COMMIT="$(git log -1 --format='%H' --author='OSBotify' --grep 'Update version to ${{ needs.createNewVersion.outputs.NEW_VERSION }}')"
          if [ -z "$VERSION_BUMP_COMMIT" ]; then
            echo "::error::❌ Could not find Mobile-Expensify version bump commit for ${{ needs.createNewVersion.outputs.NEW_VERSION }}"
            echo "::error::This may indicate E/App and Mobile-Expensify versions are out of sync"
            echo "::error::Run the syncVersions workflow to fix, then retry this cherry-pick"
            git log --oneline -20
            exit 1
          fi
          echo "::notice::👀 Found Mobile-Expensify version bump commit $VERSION_BUMP_COMMIT"
          echo "VERSION_BUMP_SHA=$VERSION_BUMP_COMMIT" >> "$GITHUB_OUTPUT"

      - name: Get merge commit for pull request to CP
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: getCPMergeCommit
        run: |
          read -r MERGE_COMMIT_SHA MERGE_ACTOR PR_AUTHOR <<< "$(gh pr view ${{ inputs.PULL_REQUEST_URL }} --json mergeCommit,mergedBy,author --jq '"\(.mergeCommit.oid) \(.mergedBy.login) \(.author.login)"')"
          {
            echo "MERGE_COMMIT_SHA=$MERGE_COMMIT_SHA"
            echo "MERGE_ACTOR=$MERGE_ACTOR"
            echo "PR_AUTHOR=$PR_AUTHOR"
          } >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}

      - name: Cherry-pick the Mobile-Expensify version bump to Mobile-Expensify target branch
        working-directory: Mobile-Expensify
        run: |
          git switch ${{ inputs.TARGET }}
          git cherry-pick -S -x --mainline 1 --strategy=recursive -Xtheirs ${{ steps.getMobileExpensifyVersionBumpCommit.outputs.VERSION_BUMP_SHA }}
          git commit --amend -m "$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"
          git push origin ${{ inputs.TARGET }}

      - name: Cherry-pick the E/App version-bump to target branch
        run: |
          git switch ${{ inputs.TARGET }}
          git cherry-pick -S -x --mainline 1 --strategy=recursive -Xtheirs ${{ steps.getVersionBumpCommit.outputs.VERSION_BUMP_SHA }}
          git commit --amend -m "$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"

      - name: Update the Mobile-Expensify submodule on E/App target branch
        run: |
          git add Mobile-Expensify
          git commit -m "Update Mobile-Expensify submodule version to ${{ needs.createNewVersion.outputs.NEW_VERSION }}"

      - name: Cherry-pick the merge commit of target PR
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: cherryPick
        # If cherry picking a Mobile-Expensify change, we need to run the cherry pick in the Mobile-Expensify directory
        working-directory: ${{ startsWith(steps.getPRInfo.outputs.REPO_FULL_NAME, 'Expensify/Mobile-Expensify') && 'Mobile-Expensify' || '.' }}
        run: |
          echo "Attempting to cherry-pick ${{ steps.getCPMergeCommit.outputs.MERGE_COMMIT_SHA }}"
          if git cherry-pick -S -x --mainline 1 ${{ steps.getCPMergeCommit.outputs.MERGE_COMMIT_SHA }}; then
            echo "🎉 No conflicts! CP was a success, PR can be automerged 🎉"
            echo "HAS_CONFLICTS=false" >> "$GITHUB_OUTPUT"
            git commit --amend -m "$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"
          else
            UNMERGED_FILES="$(git diff --name-only --diff-filter=U)"
            # A failed -S signing leaves CHERRY_PICK_HEAD with the picked changes still staged, so only a fully clean index and worktree means the pick was truly empty
            if [[ -z "$UNMERGED_FILES" ]] && git rev-parse --quiet --verify CHERRY_PICK_HEAD > /dev/null && git diff --cached --quiet && git diff --quiet; then
              echo "✅ Cherry-pick resulted in an empty commit, the change is already on ${{ inputs.TARGET }}. Skipping it and continuing with the version bump."
              git cherry-pick --skip
              echo "HAS_CONFLICTS=false" >> "$GITHUB_OUTPUT"
            else
              echo "😞 PR can't be automerged, there are merge conflicts in the following files:"
              echo "$UNMERGED_FILES"
              git cherry-pick --abort
              if [[ "${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}" =~ Expensify/Mobile-Expensify* ]]; then
                echo "::error::❌ This Mobile-Expensify PR has cherry-pick conflicts, and this workflow does not support resolving Mobile-Expensify conflicts automatically."
                echo "::error::Please manually cherry-pick ${{ inputs.PULL_REQUEST_URL }} to the Mobile-Expensify ${{ inputs.TARGET }} branch instead."
                exit 1
              fi
              echo "HAS_CONFLICTS=true" >> "$GITHUB_OUTPUT"
            fi
          fi

      - name: Push changes
        run: |
          if [[ '${{ steps.cherryPick.outputs.HAS_CONFLICTS }}' == 'true' ]]; then
            git checkout -b ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}
            git push --set-upstream origin ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}
          else
            if [[ "${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}" =~ Expensify/Mobile-Expensify* ]]; then
              # Push Mobile-Expensify changes first
              cd Mobile-Expensify
              git push origin ${{ inputs.TARGET }}
              cd ..

              # Update and commit the submodule reference in E/App
              git add Mobile-Expensify
              if git diff --cached --quiet; then
                echo "Submodule pointer unchanged, nothing to commit"
              else
                git commit -m "Update Mobile-Expensify submodule to include cherry-picked PR #${{ steps.getPRInfo.outputs.PR_NUMBER }}"
              fi
            fi

            # Push E/App changes
            if ! git push origin ${{ inputs.TARGET }}; then
              echo "E/App target branch advanced during the push; reconciling once before retrying."
              git fetch origin ${{ inputs.TARGET }} --no-recurse-submodules --no-tags
              if ! git rebase origin/${{ inputs.TARGET }}; then
                echo "::error::❌ Failed to rebase E/App changes onto the updated ${{ inputs.TARGET }} branch."
                git rebase --abort || true
                exit 1
              fi
              git push origin ${{ inputs.TARGET }}
            fi
          fi

      - name: Warn that previous deploy was superseded
        if: ${{ steps.cherryPick.outputs.HAS_CONFLICTS != 'true' && steps.checkInProgressDeploy.outputs.DEPLOY_RUN_URL != '' }}
        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            {
              "channel": "#deployer",
              "attachments": [{
                "color": "warning",
                "text": "⚠️ ${{ inputs.TARGET == 'production' && 'Production' || 'Staging' }} <${{ steps.checkInProgressDeploy.outputs.DEPLOY_RUN_URL }}|deploy> cancelled by new cherry-pick"
              }]
            }

      - name: Find deploy workflow run
        # Also runs for version-bump-only CPs where HAS_CONFLICTS is unset
        if: ${{ steps.cherryPick.outputs.HAS_CONFLICTS != 'true' }}
        id: findDeployRun
        run: |
          PUSH_SHA=$(git rev-parse HEAD)
          echo "Push SHA: $PUSH_SHA"

          DEPLOY_RUN_URL=""
          for i in 1 2 3 4 5 6; do
            echo "Polling for deploy run (attempt $i)..."
            sleep 10
            DEPLOY_RUN_URL=$(gh api \
              "repos/${{ github.repository }}/actions/workflows/deploy.yml/runs?head_sha=$PUSH_SHA&per_page=1" \
              --jq '.workflow_runs[0].html_url // empty' 2>/dev/null || true)
            if [ -n "$DEPLOY_RUN_URL" ]; then
              echo "Found deploy run: $DEPLOY_RUN_URL"
              break
            fi
          done

          FALLBACK_URL="https://github.com/${{ github.repository }}/actions/workflows/deploy.yml"
          if [ -z "$DEPLOY_RUN_URL" ]; then
            echo "::warning::Could not find deploy workflow run for SHA $PUSH_SHA"
            {
              echo "DEPLOY_RUN_FOUND=false"
              echo "DEPLOY_RUN_URL=$FALLBACK_URL"
              echo "DEPLOY_RUN_MESSAGE=⚠️ Could not locate deploy run — check $FALLBACK_URL"
            } >> "$GITHUB_OUTPUT"
          else
            {
              echo "DEPLOY_RUN_FOUND=true"
              echo "DEPLOY_RUN_URL=$DEPLOY_RUN_URL"
              echo "DEPLOY_RUN_MESSAGE=$DEPLOY_RUN_URL"
            } >> "$GITHUB_OUTPUT"
          fi
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Announce successful CP in #deployer
        # Also runs for version-bump-only CPs where HAS_CONFLICTS is unset
        if: ${{ steps.cherryPick.outputs.HAS_CONFLICTS != 'true' }}
        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            {
              "channel": "#deployer",
              "attachments": [{
                "color": "good",
                "text": "🍒 Cherry-pick to *${{ inputs.TARGET }}* successfully started\nPR: ${{ inputs.PULL_REQUEST_URL || '(version bump only)' }}\nDeploy workflow: ${{ steps.findDeployRun.outputs.DEPLOY_RUN_MESSAGE }}"
              }]
            }

      - name: Write workflow summary
        # Also runs for version-bump-only CPs where HAS_CONFLICTS is unset
        if: ${{ steps.cherryPick.outputs.HAS_CONFLICTS != 'true' }}
        run: |
          {
            echo "## Cherry-pick successful"
            echo ""
            echo "**Target:** \`${{ inputs.TARGET }}\`"
            echo "**PR:** ${{ inputs.PULL_REQUEST_URL || 'N/A (version bump only)' }}"
            if [[ "${{ steps.findDeployRun.outputs.DEPLOY_RUN_FOUND }}" == "true" ]]; then
              echo "**Deploy workflow:** ${{ steps.findDeployRun.outputs.DEPLOY_RUN_URL }}"
            else
              echo "**Deploy workflow:** :warning: Could not locate deploy run — check [${{ inputs.TARGET }} deploy runs](${{ steps.findDeployRun.outputs.DEPLOY_RUN_URL }})"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Create Pull Request to manually finish CP
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        id: createPullRequest
        run: |
          AUTHOR_CHECKLIST=$(sed -n '/### PR Author Checklist/,$p' .github/PULL_REQUEST_TEMPLATE.md)

          PR_DESCRIPTION=$(cat <<EOF
          🍒 Cherry pick ${{ inputs.PULL_REQUEST_URL }} to ${{ inputs.TARGET }} 🍒

          This PR had conflicts when we tried to cherry-pick it to ${{ inputs.TARGET }}. You'll need to manually perform the cherry-pick, using the following steps:

          \`\`\`bash
          git fetch
          git checkout ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}
          git cherry-pick -S -x --mainline 1 ${{ steps.getCPMergeCommit.outputs.MERGE_COMMIT_SHA }}
          \`\`\`

          Then manually resolve conflicts, and commit the change with \`git cherry-pick --continue\`. Lastly, please run:

          \`\`\`bash
          git commit --amend -m "\$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"
          \`\`\`

          This last part is important. It will help us keep track of who triggered this CP, and will ensure that version bumps are tracked correctly. Once all that's done, push your changes with \`git push origin ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}\`, and then open this PR for review.

          Note that you **must** test this PR, and both the author and reviewer checklist should be completed, just as if you were merging the PR to main.

          > [!IMPORTANT]
          > This PR should ideally be merged by a member of the [mobile-deployers](https://github.com/orgs/Expensify/teams/mobile-deployers) team. If it is merged by someone who is not a deployer, the staging deploy triggered by the merge will fail and will need to be manually re-triggered (not just retried) via the [deploy workflow](https://github.com/${{ github.repository }}/actions/workflows/deploy.yml).

          _Pro-tip:_ If this PR appears to have conflicts against the _${{ inputs.TARGET }}_ base, it means that the version on ${{ inputs.TARGET }} has been updated. The easiest thing to do if you see this is to close the PR and re-run the CP.

          $AUTHOR_CHECKLIST
          EOF
          )

          # Create PR
          gh pr create \
            --title "🍒 Cherry pick PR #${{ steps.getPRInfo.outputs.PR_NUMBER }} to ${{ inputs.TARGET }} 🍒" \
            --body "$PR_DESCRIPTION" \
            --label "Engineering,Hourly,${{ inputs.TARGET == 'staging' && 'CP Staging' || 'CP Production' }}" \
            --base "${{ inputs.TARGET }}"
          sleep 5

          # Save the Cherry-pick PR URL for Slack notification
          PR_URL="$(gh pr view --json url --jq .url)"
          echo "PR_URL=$PR_URL" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}

      - name: Resolve Slack mentions for merge actor and CP initiator
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        id: resolveSlack
        run: |
          # Match Slack IDs to Github IDs using the whitelist
          WHITELIST=$(gh api repos/Expensify/Salt/contents/www/files/www-whitelist.php \
            --jq '.content' | base64 -d 2>/dev/null || true)

          resolve_slack_id() {
            local github_user="$1"
            if [ -n "$WHITELIST" ] && [ -n "$github_user" ]; then
              echo "$WHITELIST" \
                | grep -F -A 10 "'github' => '$github_user'" \
                | grep -oP -m 1 "'slack'\s*=>\s*'\K[^']+" || true
            fi
          }

          PR_AUTHOR="${{ steps.getCPMergeCommit.outputs.PR_AUTHOR }}"
          MERGER="${{ steps.getCPMergeCommit.outputs.MERGE_ACTOR }}"
          CP_INITIATOR="${{ github.actor }}"

          PR_AUTHOR_SLACK=$(resolve_slack_id "$PR_AUTHOR")
          MERGER_SLACK=$(resolve_slack_id "$MERGER")
          CP_SLACK=$(resolve_slack_id "$CP_INITIATOR")

          # Collect unique, successfully resolved Slack IDs; fall back to @appdeployers if none resolve
          MENTIONS=""
          SEEN=""
          for sid in $PR_AUTHOR_SLACK $MERGER_SLACK $CP_SLACK; do
            pattern=" $sid "
            if [ -n "$sid" ] && [[ ! " $SEEN " =~ $pattern ]]; then
              MENTIONS="${MENTIONS:+$MENTIONS / }<@$sid>"
              SEEN="$SEEN $sid"
            fi
          done

          if [ -z "$MENTIONS" ]; then
            echo "SLACK_MENTION=<!subteam^S4TJJ3PSL>" >> "$GITHUB_OUTPUT"
          else
            echo "SLACK_MENTION=$MENTIONS" >> "$GITHUB_OUTPUT"
          fi
        env:
          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}

      - name: Announce CP conflict in #deployer
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            {
              "channel": "#deployer",
              "attachments": [{
                "color": "#DB4545",
                "pretext": "${{ steps.resolveSlack.outputs.SLACK_MENTION }}",
                "text": "🚨 Cherry-pick to ${{ inputs.TARGET }} has conflicts and requires manual resolution.\nOriginal PR: ${{ inputs.PULL_REQUEST_URL }}\nConflict PR: ${{ steps.createPullRequest.outputs.PR_URL }}"
              }]
            }

      - name: Add assignees to conflict PRs
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        run: |
          gh pr edit --add-assignee "${{ github.actor }},${{ steps.getCPMergeCommit.outputs.MERGE_ACTOR }},${{ steps.getCPMergeCommit.outputs.PR_AUTHOR }}"
        env:
          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
        # In cases when the original PR author is outside the org, the `gh pr edit` command will fail. But we don't want to fail the workflow in that case.
        continue-on-error: true

      - name: Label original PR with CP label
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        run: gh pr edit ${{ inputs.PULL_REQUEST_URL }} --add-label '${{ inputs.TARGET == 'staging' && 'CP Staging' || 'CP Production' }}'
        env:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}

      - name: 'Announces a CP failure in the #announce Slack room'
        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        if: ${{ failure() }}
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            {
              "channel": "#announce",
              "attachments": [{
                "color": "#DB4545",
                "pretext": "<!subteam^S4TJJ3PSL>",
                "text": "💥 Failed to CP ${{ inputs.PULL_REQUEST_URL }} to ${{ inputs.TARGET }} 💥"
              }]
            }

      - name: 'Announce CP cancellation in #deployer'
        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        if: ${{ cancelled() }}
        with:
          webhook: ${{ secrets.SLACK_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            {
              "channel": "#deployer",
              "attachments": [{
                "color": "warning",
                "text": "🍒 Cherry-pick to *${{ inputs.TARGET }}* was cancelled\nPR: ${{ inputs.PULL_REQUEST_URL || '(version bump only)' }}\nWorkflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
              }]
            }