feat: add release-beta-lock action [ED-25903]

actions/release-beta-lock/action.yml

@@ -0,0 +1,34 @@
+name: Release Beta Lock
+description: >-
+    Locks or unlocks the beta release branch for merges by toggling a dedicated repository ruleset
+    with an "update" rule. The ruleset is created on first run.
+    Requires a token with repository Administration write permission; GITHUB_TOKEN is not sufficient.
+
+inputs:
+    token:
+        description: Token with repository Administration write permission (PAT or GitHub App token)
+        required: true
+    state:
+        description: 'Target state: "locked" or "unlocked"'
+        required: true
+    branch:
+        description: Branch to lock or unlock
+        required: false
+        default: release/beta
+    ruleset-name:
+        description: Name of the ruleset that holds the lock
+        required: false
+        default: Release beta lock
+
+runs:
+    using: composite
+    steps:
+        - name: Apply lock state
+          shell: bash
+          env:
+              GH_TOKEN: ${{ inputs.token }}
+              STATE: ${{ inputs.state }}
+              BRANCH: ${{ inputs.branch }}
+              RULESET_NAME: ${{ inputs.ruleset-name }}
+              ACTION_PATH: ${{ github.action_path }}
+          run: bash "$ACTION_PATH/release-beta-lock.sh"

actions/release-beta-lock/package.json

@@ -0,0 +1,9 @@
+{
+	"name": "@elementor/release-beta-lock",
+	"author": "Elementor Team",
+	"license": "GPL-3.0-or-later",
+	"private": true,
+	"scripts": {
+		"test": "bash release-beta-lock.test.sh"
+	}
+}

actions/release-beta-lock/release-beta-lock.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Locks or unlocks a release branch by toggling the enforcement of a dedicated
+# repository ruleset holding a single "update" rule. Creates the ruleset when missing.
+
+set -euo pipefail
+
+REPO="${GITHUB_REPOSITORY:-}"
+STATE="${STATE:-}"
+BRANCH="${BRANCH:-release/beta}"
+export RULESET_NAME="${RULESET_NAME:-Release beta lock}"
+
+resolve_enforcement() {
+	case "$1" in
+		locked) echo "active" ;;
+		unlocked) echo "disabled" ;;
+		*) return 1 ;;
+	esac
+}
+
+find_ruleset_id() {
+	local ids
+	ids="$(gh api "repos/${REPO}/rulesets" --paginate --jq '.[] | select(.name == env.RULESET_NAME and .source_type == "Repository") | .id')" || return $?
+	echo "$ids" | head -n 1
+}
+
+build_ruleset_payload() {
+	local enforcement="$1"
+
+	jq -n \
+		--arg name "$RULESET_NAME" \
+		--arg ref "refs/heads/${BRANCH}" \
+		--arg enforcement "$enforcement" \
+		'{
+			name: $name,
+			target: "branch",
+			enforcement: $enforcement,
+			conditions: { ref_name: { include: [$ref], exclude: [] } },
+			rules: [{ type: "update" }]
+		}'
+}
+
+apply_lock_state() {
+	local enforcement ruleset_id
+
+	if [ -z "$REPO" ]; then
+		echo "::error::GITHUB_REPOSITORY is not set"
+		return 1
+	fi
+
+	if ! enforcement="$(resolve_enforcement "$STATE")"; then
+		echo "::error::Invalid state '${STATE}'. Expected 'locked' or 'unlocked'"
+		return 1
+	fi
+
+	if ! ruleset_id="$(find_ruleset_id)"; then
+		report_api_failure "list rulesets"
+		return 1
+	fi
+
+	if [ -z "$ruleset_id" ]; then
+		if ! build_ruleset_payload "$enforcement" | gh api --method POST "repos/${REPO}/rulesets" --input - >/dev/null; then
+			report_api_failure "create ruleset '${RULESET_NAME}'"
+			return 1
+		fi
+		echo "::notice::Created ruleset '${RULESET_NAME}' - ${BRANCH} is now ${STATE}"
+	else
+		if ! build_ruleset_payload "$enforcement" | gh api --method PUT "repos/${REPO}/rulesets/${ruleset_id}" --input - >/dev/null; then
+			report_api_failure "update ruleset '${RULESET_NAME}' (#${ruleset_id})"
+			return 1
+		fi
+		echo "::notice::Updated ruleset '${RULESET_NAME}' (#${ruleset_id}) - ${BRANCH} is now ${STATE}"
+	fi
+}
+
+report_api_failure() {
+	local operation="$1"
+
+	echo "::error title=Release beta lock failed::Could not ${operation}, so ${BRANCH} was NOT ${STATE}. The token needs repository Administration write permission."
+}
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+	apply_lock_state
+fi