# https://github.com/tensorflow/tensorflow/actions/workflows/release-branch-cherrypick.yml
# and click "Run Workflow." Leave "Use Workflow From" set to "master", then
# input the branch name and paste the cherry-pick commit and click Run. A PR
# will be created.

name: Release Branch Cherrypick
on:
  workflow_dispatch:
    inputs:
      # We use this instead of the "run on branch" argument because GitHub looks

name: Upload SIG Build docker containers modified for release branches

on:
  workflow_dispatch:
  push:
    paths:
      - '.github/workflows/sigbuild-docker-branch.yml'
      - 'tensorflow/tools/tf_sig_build_dockerfiles/**'
      - '!tensorflow/tools/tf_sig_build_dockerfiles/README.md'
    branches:
      - "r[1-9].[0-9]+"

permissions:
  contents: read

jobs:
  docker:

     * should be enabled, i.e. when new commits are pushed to this branch, should a ReadyForNightly job
     * be triggered automatically?
     *
     * Currently, we only enable VCS trigger for `master`/`release`/`releaseNx` branches.
     */
    val enableVcsTriggers: Boolean = nightlyPromotionTriggerHour != null

    companion object {
        private

            branch=${PR_HEAD_LABEL#*:}
          else
            user=${GITHUB_REPOSITORY%/*}
            branch=${GITHUB_REF#refs/heads/}
          fi
          if [ $branch != "master" ]; then
            git ls-remote https://github.com/$user/$repo.git | grep "refs/heads/${branch}$" > /dev/null
            if [ $? -eq 0 ]; then

on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '26 3 * * 2'
  push:
    branches: [ "master" ]

    buildType(PublishNightlySnapshotFromQuickFeedbackStepPromote(branch))
    buildType(PublishBranchSnapshotFromQuickFeedback)
    buildType(PublishMilestone(branch))

    if (branch.isMaster) {
        buildType(StartReleaseCycle)
        buildType(StartReleaseCycleTest)
    } else {
        buildType(PublishReleaseCandidate(branch))
        buildType(PublishFinalRelease(branch))
    }

# Release Branches

Release branches have a name of `release-MAJOR.MINOR`. Essential Istio repositories are branched from master roughly 4
weeks prior to a new release. The `istio/istio.io` repository does not get branched until the release is ready
for publication.

This document outlines getting in new features after a new branch has been cut and the process for getting a PR
merged in before and after the first public release.

# Feature Freeze

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '45 9 * * 0'
  push:
    branches: [ "master" ]

name: Set nightly branch to master HEAD

permissions: {}

jobs:
  master-to-nightly:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: zofrex/mirror-branch@0be56f4c8077a288a635a491b306ba0bb1c810e6 # v1.0.4
      name: Set nightly branch to master HEAD
      with:

                <configuration>
                    <format>kotlin</format>
                    <dstDir>target/generated-configs</dstDir>
                    <contextParameters>
                        <Branch>${dslContextParameter.branch}</Branch>
                    </contextParameters>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>