From ce328fbd1eba3aee015c0ad7b241df6aacd14cff Mon Sep 17 00:00:00 2001
From: kawaiipunk <kawaiipunk@posteo.net>
Date: Thu, 13 Aug 2026 01:33:26 +0200
Subject: [PATCH] Add Drone CI pipeline for builds, checks, and auto-merge

---
 .drone.yml | 198 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 198 insertions(+)
 create mode 100644 .drone.yml

diff --git a/.drone.yml b/.drone.yml
new file mode 100644
index 0000000..ae6340d
--- /dev/null
+++ b/.drone.yml
@@ -0,0 +1,198 @@
+---
+kind: pipeline
+type: docker
+name: ci
+
+trigger:
+  event:
+    - push
+    - pull_request
+  branch:
+    - main
+
+steps:
+  - name: check
+    image: alpine:3.20
+    commands:
+      - apk add --no-cache bash >/dev/null
+      - |
+        set -eu
+        bash -n build.sh check-versions.sh update-version.sh versions.sh
+        ./check-versions.sh
+
+  - name: build
+    image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-24.08
+    privileged: true
+    commands:
+      - |
+        set -eu
+        flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+        flatpak install -y flathub org.electronjs.Electron2.BaseApp//24.08
+        flatpak-builder --repo=repo --force-clean build-dir nz.scuttlebutt.Patchwork.yaml
+
+  - name: merge
+    image: alpine:3.20
+    when:
+      event:
+        - pull_request
+    environment:
+      GITHUB_TOKEN:
+        from_secret: github_token
+    commands:
+      - apk add --no-cache curl jq >/dev/null
+      - |
+        set -eu
+        PR=$(curl -fsSL -H "Authorization: token ${GITHUB_TOKEN}" \
+          "https://api.github.com/repos/${DRONE_REPO}/pulls/${DRONE_PULL_REQUEST}") || exit 0
+        STATE=$(printf '%s' "$PR" | jq -r '.state')
+        HEAD_REF=$(printf '%s' "$PR" | jq -r '.head.ref')
+        MERGEABLE=$(printf '%s' "$PR" | jq -r '.mergeable_state')
+        HAS_LABEL=$(printf '%s' "$PR" | jq -r 'has("labels") and ([.labels[].name] | index("automerge") != null)')
+        case "$HEAD_REF" in
+          update-patchwork-*) ;;
+          *)
+            echo "skipping auto-merge (head=${HEAD_REF})"
+            exit 0
+            ;;
+        esac
+        if [ "$STATE" != "open" ] || [ "$MERGEABLE" != "clean" ] || [ "$HAS_LABEL" != "true" ]; then
+          echo "skipping auto-merge (state=${STATE} mergeable=${MERGEABLE} label=${HAS_LABEL})"
+          exit 0
+        fi
+        curl -fsSL -X PUT -H "Authorization: token ${GITHUB_TOKEN}" \
+          -H "Accept: application/vnd.github.v3+json" \
+          "https://api.github.com/repos/${DRONE_REPO}/pulls/${DRONE_PULL_REQUEST}/merge" \
+          -d '{"merge_method":"squash","delete_branch":true}'
+        echo "Merged PR #${DRONE_PULL_REQUEST}"
+
+---
+kind: pipeline
+type: docker
+name: update
+
+trigger:
+  event:
+    - cron
+  cron:
+    - nightly
+
+steps:
+  - name: bump
+    image: alpine:3.20
+    environment:
+      GITHUB_TOKEN:
+        from_secret: github_token
+    commands:
+      - apk add --no-cache git curl jq bash >/dev/null
+      - |
+        set -eu
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        bash update-version.sh
+        if git diff --quiet; then
+          echo "No upstream changes."
+          exit 0
+        fi
+        . ./versions.sh
+        BRANCH="update-patchwork-${APP_VERSION}"
+        REMOTE="https://${GITHUB_TOKEN}@github.com/${DRONE_REPO}.git"
+        if git ls-remote --heads "$REMOTE" "refs/heads/${BRANCH}" | grep -q "refs/heads/${BRANCH}$"; then
+          echo "Branch ${BRANCH} already exists (a PR is probably open); nothing to do."
+          exit 0
+        fi
+        git checkout -b "${BRANCH}"
+        git add versions.sh nz.scuttlebutt.Patchwork.yaml nz.scuttlebutt.Patchwork.metainfo.xml
+        git commit -m "Update Patchwork to ${APP_VERSION}"
+        git push "$REMOTE" "${BRANCH}"
+        BODY=$(cat <<EOF
+        Bump the pinned Patchwork (Poncho Wonky) release to **${APP_VERSION}**.
+
+        - x86_64 sha256: \`${APP_SHA256_X86_64}\`
+        - aarch64 sha256: \`${APP_SHA256_AARCH64}\`
+
+        See https://github.com/soapdog/patchwork/releases/tag/v${APP_VERSION}
+
+        CI builds the manifest and this PR auto-merges once the checks pass.
+        EOF
+        )
+        PR_JSON=$(curl -fsSL -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
+          -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/${DRONE_REPO}/pulls" \
+          -d "$(jq -n --arg t "Update Patchwork to ${APP_VERSION}" \
+            --arg h "${BRANCH}" --arg b "main" --arg body "$BODY" \
+            '{title:$t, head:$h, base:$b, body:$body}')")
+        PR_NUMBER=$(printf '%s' "$PR_JSON" | jq -r '.number')
+        if [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" = "null" ]; then
+          echo "PR creation failed:"
+          printf '%s\n' "$PR_JSON"
+          exit 1
+        fi
+        curl -fsSL -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
+          "https://api.github.com/repos/${DRONE_REPO}/issues/${PR_NUMBER}/labels" \
+          -d '{"labels":["automerge"]}'
+        echo "Opened PR #${PR_NUMBER} (${BRANCH})"
+
+---
+kind: pipeline
+type: docker
+name: update-manual
+
+trigger:
+  event:
+    - custom
+
+steps:
+  - name: bump
+    image: alpine:3.20
+    environment:
+      GITHUB_TOKEN:
+        from_secret: github_token
+    commands:
+      - apk add --no-cache git curl jq bash >/dev/null
+      - |
+        set -eu
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        bash update-version.sh
+        if git diff --quiet; then
+          echo "No upstream changes."
+          exit 0
+        fi
+        . ./versions.sh
+        BRANCH="update-patchwork-${APP_VERSION}"
+        REMOTE="https://${GITHUB_TOKEN}@github.com/${DRONE_REPO}.git"
+        if git ls-remote --heads "$REMOTE" "refs/heads/${BRANCH}" | grep -q "refs/heads/${BRANCH}$"; then
+          echo "Branch ${BRANCH} already exists (a PR is probably open); nothing to do."
+          exit 0
+        fi
+        git checkout -b "${BRANCH}"
+        git add versions.sh nz.scuttlebutt.Patchwork.yaml nz.scuttlebutt.Patchwork.metainfo.xml
+        git commit -m "Update Patchwork to ${APP_VERSION}"
+        git push "$REMOTE" "${BRANCH}"
+        BODY=$(cat <<EOF
+        Bump the pinned Patchwork (Poncho Wonky) release to **${APP_VERSION}**.
+
+        - x86_64 sha256: \`${APP_SHA256_X86_64}\`
+        - aarch64 sha256: \`${APP_SHA256_AARCH64}\`
+
+        See https://github.com/soapdog/patchwork/releases/tag/v${APP_VERSION}
+
+        CI builds the manifest and this PR auto-merges once the checks pass.
+        EOF
+        )
+        PR_JSON=$(curl -fsSL -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
+          -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/${DRONE_REPO}/pulls" \
+          -d "$(jq -n --arg t "Update Patchwork to ${APP_VERSION}" \
+            --arg h "${BRANCH}" --arg b "main" --arg body "$BODY" \
+            '{title:$t, head:$h, base:$b, body:$body}')")
+        PR_NUMBER=$(printf '%s' "$PR_JSON" | jq -r '.number')
+        if [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" = "null" ]; then
+          echo "PR creation failed:"
+          printf '%s\n' "$PR_JSON"
+          exit 1
+        fi
+        curl -fsSL -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
+          "https://api.github.com/repos/${DRONE_REPO}/issues/${PR_NUMBER}/labels" \
+          -d '{"labels":["automerge"]}'
+        echo "Opened PR #${PR_NUMBER} (${BRANCH})"