RDKE-1120: Automated component release workflow

.github/workflows/README.md

@@ -0,0 +1,105 @@
+# Automated Release Workflow
+
+Automates main release and hotfix flows via GitHub Actions.
+
+## Workflows
+
+### 1. Component Release (component-release.yml)
+
+Triggered manually from the Actions tab via workflow_dispatch.
+
+#### Inputs
+
+| Input | Required | Description |
+|-------|----------|-------------|
+| release_version | Yes | Release version (for example: 1.0.0, 1.0.0-rc1) |
+| release_type | Yes | main or hotfix |
+| release_mode | Yes | approvable or auto-complete (ignored for hotfix) |
+| source_branch | Hotfix only | Support branch for hotfix (for example: support/1.0) |
+
+#### Concurrency
+
+Runs are serialized per release key:
+
+- component-release-<release_type>-<release_version>
+
+This prevents two runs for the same version/type from racing on branches/tags.
+
+#### Release Modes
+
+Main release - auto-complete
+1. Validates version format.
+2. Runs git flow release start -> changelog -> release publish -> release finish.
+3. Pushes main, develop, and tags.
+4. Deletes remote release/<version> branch after successful finish.
+
+Main release - approvable
+1. Validates version format.
+2. Runs git flow release start -> changelog -> release publish.
+3. Creates a PR: release/<version> -> main.
+4. Stops and waits for PR approval.
+5. On approval, the second workflow finishes the release.
+
+Hotfix (always auto-complete)
+1. Requires source_branch input.
+2. Validates source_branch against ^[A-Za-z0-9._/-]+$.
+3. Creates/uses hotfix/<version> from source_branch, updates changelog, merges back into source_branch only.
+4. Creates tag <version>.
+5. Pushes only source_branch and tag (main/develop are not pushed).
+
+### 2. Component Release Finish On Approval (component-release-finish-on-approval.yml)
+
+Triggered on approved review for release/* PRs targeting main.
+
+#### What it does
+1. Verifies PR review decision is APPROVED.
+2. Checks out release branch.
+3. Runs git flow release finish (merge to main + develop, create tag).
+4. Pushes main, develop, and tags.
+5. Deletes remote release/<version> branch.
+6. Closes the release PR.
+
+## Authentication and Secrets
+
+Both workflows use:
+
+- RDKCM_DEPLOY_KEY: SSH private key used by checkout and git push operations.
+- github.token: built-in ephemeral GitHub Actions token used by gh API/CLI calls.
+
+Why github.token:
+
+- It is automatically provided for each workflow run.
+- It avoids introducing a custom repository secret for API access.
+- It works with the workflow permissions already declared in the job.
+
+## Failure Cleanup Safety
+
+On failure, cleanup only removes refs created by the current run:
+
+- Deletes tag only if the run created that tag.
+- Deletes release/<version> only if the run created that local release branch.
+- Deletes hotfix/<version> only if the run created that local hotfix branch.
+- Skips cleanup if repository checkout is unavailable.
+
+## Prerequisites
+
+### Repository Settings
+
+- Settings -> Actions -> General -> Workflow permissions: set to Read and write permissions.
+- Settings -> Actions -> General: enable Allow GitHub Actions to create and approve pull requests.
+
+### Branch Protection
+
+- For approvable flow: enforce PR review rules on main.
+- For auto-complete flow pushes to develop: ensure the automation actor has appropriate bypass rights in repository rules.
+
+## Version Format
+
+Accepted examples:
+
+- 1.0.0
+- 1.0.0-rc1
+- 1.0.0v1
+- 1.0.0.beta2
+
+Rule: major.minor.patch digits with optional suffix.

.github/workflows/component-release-finish-on-approval.yml

@@ -0,0 +1,115 @@
+name: Component Release Finish On Approval
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-finish-${{ github.event.pull_request.head.ref }}
+  cancel-in-progress: false
+
+jobs:
+  finish-release:
+    name: Finish release when PR is approved
+    if: >
+      github.event.review.state == 'approved' &&
+      github.event.pull_request.base.ref == 'main' &&
+      startsWith(github.event.pull_request.head.ref, 'release/')
+    runs-on: ubuntu-latest
+    env:
+      REPO: ${{ github.repository }}
+      ACTOR: ${{ github.event.review.user.login }}
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
+
+    steps:
+      - name: Check approval status
+        id: approvals
+        run: |
+          set -euo pipefail
+          pr_number="${{ github.event.pull_request.number }}"
+          decision=$(gh pr view --repo "${REPO}" "${pr_number}" --json reviewDecision -q '.reviewDecision')
+          echo "PR #${pr_number} review decision: ${decision}"
+          if [ "${decision}" = "APPROVED" ]; then
+            echo "should_finish=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "PR is not fully approved yet. Waiting."
+            echo "should_finish=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout repository
+        if: steps.approvals.outputs.should_finish == 'true'
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ssh-key: ${{ secrets.RDKCM_DEPLOY_KEY }}
+
+      - name: Install release tools
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y git-flow
+
+      - name: Configure git identity
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          git config user.name "${ACTOR}"
+          git config user.email "${ACTOR}@users.noreply.github.com"
+
+      - name: Finish release and push
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          release_version="${RELEASE_BRANCH#release/}"
+
+          git fetch --prune origin
+
+          if git ls-remote --exit-code --tags origin "refs/tags/${release_version}" >/dev/null 2>&1; then
+            echo "Tag ${release_version} already exists on origin. Skipping release finish."
+            exit 0
+          fi
+
+          if git show-ref --verify --quiet "refs/heads/${RELEASE_BRANCH}"; then
+            git checkout "${RELEASE_BRANCH}"
+          elif git ls-remote --exit-code --heads origin "${RELEASE_BRANCH}" >/dev/null 2>&1; then
+            git checkout -b "${RELEASE_BRANCH}" "origin/${RELEASE_BRANCH}"
+          else
+            echo "${RELEASE_BRANCH} does not exist locally or on origin."
+            exit 1
+          fi
+
+          git checkout main 2>/dev/null || git checkout -b main origin/main
+          git checkout develop 2>/dev/null || git checkout -b develop origin/develop
+          git checkout "${RELEASE_BRANCH}"
+
+          git flow init -d
+
+          git flow release finish -m "Release ${release_version}" "${release_version}"
+          git push origin main
+          git push origin --tags
+          git push origin develop
+          git push origin --delete "${RELEASE_BRANCH}" || true
+
+      - name: Close the release PR
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          pr_number="${{ github.event.pull_request.number }}"
+          gh pr close "${pr_number}" --repo "${REPO}" --comment "Release finished by automation. Merged via git flow release finish." || true
+
+      - name: Workflow summary
+        if: always()
+        run: |
+          {
+            echo "## Release Finish On Approval"
+            echo "- Repository: ${REPO}"
+            echo "- Release branch: ${RELEASE_BRANCH}"
+            echo "- Triggered by review: ${{ github.event.review.state }}"
+            echo "- Finished release: ${{ steps.approvals.outputs.should_finish || 'false' }}"
+          } >> "$GITHUB_STEP_SUMMARY"