ci: preserve *-maintenance branches when merging PRs

.github/workflows/delete-merged-branches.yml

@@ -0,0 +1,75 @@
+#
+#   Delete Merged Branches
+#
+# Deletes the head branch of a merged pull request, except for branches
+# matching `<major>.<minor>-maintenance` (1-3 digit version components,
+# e.g. `0.19-maintenance`). This replaces GitHub's repo-wide
+# "Automatically delete head branches" setting, which cannot exclude
+# long-lived release branches that we cherry-pick fixes onto and keep
+# around.
+#
+# Repo setting "Automatically delete head branches" must be DISABLED for
+# this workflow to be the single source of truth; otherwise the setting
+# wins for non-maintenance branches and races this workflow.
+#
+# Guards:
+#   - PR must be merged (not just closed)
+#   - head and base repo must be the same (skip cross-repo forks; GitHub
+#     cannot delete fork branches anyway)
+#   - head branch must not match `<major>.<minor>-maintenance` (e.g.
+#     `0.19-maintenance`), the only naming convention we use for
+#     long-lived release branches
+#
+# The delete call is tolerant: if the branch is already gone (manual
+# delete, or another workflow beat us to it) the job still succeeds.
+
+name: Delete Merged Branches
+
+on:
+  pull_request_target:
+    types: [closed]
+
+permissions:
+  contents: write
+
+jobs:
+  delete-branch:
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete head branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+        run: |
+          # Maintenance branches use `<major>.<minor>-maintenance` with
+          # 1-3 digit version components (e.g. `0.19-maintenance`). GitHub
+          # Actions expressions cannot express this, so the precise check
+          # lives here instead of in the job-level `if:`.
+          if [[ "$BRANCH" =~ ^[0-9]{1,3}\.[0-9]{1,3}-maintenance$ ]]; then
+            echo "::notice::Preserving maintenance branch $BRANCH."
+            exit 0
+          fi
+          set +e
+          output=$(gh api -X DELETE "repos/$REPO/git/refs/heads/$BRANCH" 2>&1)
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          if [ "$status" -eq 0 ]; then
+            echo "::notice::Deleted head branch $BRANCH."
+            exit 0
+          fi
+          # GitHub returns HTTP 422 "Reference does not exist" when the
+          # branch is already gone - treat that exact response as success
+          # so re-runs and races stay green. Other failures (404 from a
+          # wrong repo/permission, 5xx, etc.) must still fail the job.
+          if printf '%s' "$output" | grep -q 'HTTP 422' \
+            && printf '%s' "$output" | grep -qi 'Reference does not exist'; then
+            echo "::notice::Head branch $BRANCH was already deleted."
+            exit 0
+          fi
+          echo "::error::Failed to delete head branch $BRANCH - see log above."
+          exit 1