Update version and downmerge workflows (#171)

* Test workflow permissions for writing actions

* Test removing actions write permission

* Add new JReleaser workflow dependency and remove token permissions

* Add runnable label to job name

* Update downmerge workflow to allow for parameterized source branch, multi target branch, semver incrementing options

* Remove runnable prefix in favor or reusable marking themselves as such

* Create auto downmerge action for aepsdk-commons

* Add GH_TOKEN required by gh CLI

* Fix unescaped backticks

* Update versions workflow to accept custom pr title and body

* Try different syntax

* Try different syntax

* Add (Reusable) prefix to reusable workflows for easier navigation in commons actions

* Add z prefix to have them sorted last in actions list

* Update downmerge workflow to skip duplicate branches and skip creating PR if no changes

* Update iOS workflow versions to `gha-ios-5.3.3`

* Update Android workflow versions to `gha-android-3.4.4`

* Update versions workflow to 3.4.4

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: timkimadobe

.github/workflows/android-bom-release.yml

@@ -50,7 +50,7 @@ jobs:
         run: make -C android/aepsdk-bom bom-publish-main
 
       - name: Generate JReleaser configuration
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.4
         with:
           staging-dir: android/aepsdk-bom/sdk-bom/build/staging-deploy
 

.github/workflows/android-bom-snapshot.yml

@@ -43,7 +43,7 @@ jobs:
         run: make -C android/aepsdk-bom bom-publish-snapshot
 
       - name: Generate JReleaser configuration
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.4
         with:
           staging-dir: android/aepsdk-bom/sdk-bom/build/staging-deploy
 

.github/workflows/android-build-and-test.yml

@@ -10,7 +10,7 @@
 # governing permissions and limitations under the License.
 #
 
-name: Build and Test (Android)
+name: z(Reusable) Build and Test (Android)
 
 on:
   workflow_call:
@@ -49,20 +49,20 @@ on:
 jobs:
   validate-code:
     name: Validate Code
-    uses: adobe/aepsdk-commons/.github/workflows/android-validate-code.yml@gha-android-3.4.3
+    uses: adobe/aepsdk-commons/.github/workflows/android-validate-code.yml@gha-android-3.4.4
 
   javadoc:
     name: Javadoc
     needs: validate-code
-    uses: adobe/aepsdk-commons/.github/workflows/android-javadoc.yml@gha-android-3.4.3
+    uses: adobe/aepsdk-commons/.github/workflows/android-javadoc.yml@gha-android-3.4.4
     with:
       javadoc-build-path: ${{ inputs.javadoc-build-path }}
 
   test-unit:
     name: Unit Test
     needs: validate-code
     if: inputs.run-test-unit
-    uses: adobe/aepsdk-commons/.github/workflows/android-custom-command-build-and-test.yml@gha-android-3.4.3
+    uses: adobe/aepsdk-commons/.github/workflows/android-custom-command-build-and-test.yml@gha-android-3.4.4
     with:
       android-api-levels: ${{ inputs.android-api-levels }}
       command: make unit-test-coverage
@@ -74,7 +74,7 @@ jobs:
     name: Functional Test
     needs: validate-code
     if: inputs.run-test-functional
-    uses: adobe/aepsdk-commons/.github/workflows/android-custom-command-build-and-test.yml@gha-android-3.4.3
+    uses: adobe/aepsdk-commons/.github/workflows/android-custom-command-build-and-test.yml@gha-android-3.4.4
     with:
       android-api-levels: ${{ inputs.android-api-levels }}
       command: make functional-test-coverage
@@ -86,7 +86,7 @@ jobs:
     name: Integration Test
     needs: validate-code
     if: inputs.run-test-integration
-    uses: adobe/aepsdk-commons/.github/workflows/android-custom-command-build-and-test.yml@gha-android-3.4.3
+    uses: adobe/aepsdk-commons/.github/workflows/android-custom-command-build-and-test.yml@gha-android-3.4.4
     with:
       android-api-levels: ${{ inputs.android-api-levels }}
       command: make integration-test-coverage
@@ -105,7 +105,7 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Dependencies
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.4
 
       - name: Assemble App
         run: make assemble-app

.github/workflows/android-custom-command-build-and-test.yml

@@ -10,7 +10,7 @@
 # governing permissions and limitations under the License.
 #
 
-name: Custom Command Build and Test (Android)
+name: z(Reusable) Custom Command Build and Test (Android)
 
 on:
   workflow_call:
@@ -113,7 +113,7 @@ jobs:
     steps:
       - name: Setup Dependencies
         id: setup-dependencies
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.4
         with:
           android-api-level: ${{ matrix.api-level }}
 

.github/workflows/android-javadoc.yml

@@ -10,7 +10,7 @@
 # governing permissions and limitations under the License.
 #
 
-name: Javadoc
+name: z(Reusable) Javadoc
 
 on:
   workflow_call:
@@ -33,7 +33,7 @@ jobs:
 
       - name: Setup Dependencies
         id: setup-dependencies
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.4
 
       - name: Javadoc
         run: make javadoc

.github/workflows/android-maven-release.yml

@@ -10,7 +10,7 @@
 # governing permissions and limitations under the License.
 #
 
-name: Publish Release (Android)
+name: z(Reusable) Publish Release (Android)
 
 # Workflow requirements:
 #  
@@ -104,7 +104,7 @@ on:
 jobs:
   validate-versions:
     name: Validate Versions
-    uses: adobe/aepsdk-commons/.github/workflows/versions.yml@gha-android-3.4.3
+    uses: adobe/aepsdk-commons/.github/workflows/versions.yml@gha-android-3.4.4
     with:
       name: ${{ inputs.version-validation-name }}
       version: ${{ github.event.inputs.tag }}
@@ -181,7 +181,7 @@ jobs:
           fi
 
       - name: Generate JReleaser configuration
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.4
         with:
           staging-dir: ${{ inputs.staging-dir }}
 

.github/workflows/android-maven-snapshot.yml

@@ -10,7 +10,7 @@
 # governing permissions and limitations under the License.
 #
 
-name: Publish Snapshot (Android)
+name: z(Reusable) Publish Snapshot (Android)
 
 # Workflow requirements:
 #  
@@ -93,7 +93,7 @@ jobs:
           fi
 
       - name: Generate JReleaser configuration
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-jreleaser-configuration@gha-android-3.4.4
         with:
           staging-dir: ${{ inputs.staging-dir }}
 

.github/workflows/android-validate-code.yml

@@ -10,7 +10,7 @@
 # governing permissions and limitations under the License.
 #
 
-name: Validate Code (Android)
+name: z(Reusable) Validate Code (Android)
 
 on:
   workflow_call:
@@ -26,7 +26,7 @@ jobs:
 
       - name: Setup Dependencies
         id: setup-dependencies
-        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.3
+        uses: adobe/aepsdk-commons/.github/actions/android-setup-dependencies-action@gha-android-3.4.4
 
       - name: Lint Source Code
         run: make lint

.github/workflows/auto-downmerge.yml

@@ -0,0 +1,29 @@
+#
+# Copyright 2025 Adobe. All rights reserved.
+# This file is licensed to you under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under
+# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+# OF ANY KIND, either express or implied. See the License for the specific language
+# governing permissions and limitations under the License.
+#
+
+name: Auto downmerge main into dev branches
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+jobs:
+  call-downmerge:
+    # This checks that a PR was merged, not just closed
+    if: github.event_name == 'push' || github.event.pull_request.merged == true
+    uses: ./.github/workflows/downmerge-to-dev.yml
+    with:
+      target-branches: "dev dev-actions"
+    secrets: inherit

.github/workflows/downmerge-to-dev.yml

@@ -10,18 +10,23 @@
 # governing permissions and limitations under the License.
 #
 
-name: Downmerge main -> dev
+name: z(Reusable) Downmerge main -> dev
 
 on:
   workflow_call:
     inputs:
-      dev-branch-name:
-        description: 'Branch to receive changes from main. Default is "dev".'
+      source-branch-name:
+        description: 'Branch to merge from. Default is "main".'
+        type: string
+        default: 'main'
+      
+      target-branches:
+        description: 'Space separated list of branches that should receive pull requests. Example: "dev dev-actions"'
         type: string
         default: 'dev'
 
-      create-new-branch:
-        description: 'Create a new branch from main instead of merging main into the dev branch. Default is false.'
+      increment-target-branch:
+        description: 'If true, automatically compute and create the next semver branch, where target-branches is interpreted as a list of prefixes. Example: "dev- dev-v" (dev-1.2.3, dev-v1.2.3 exist) → "dev-1.2.4 dev-v1.2.4"'
         type: boolean
         default: false
 
@@ -31,11 +36,14 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    env:
+      GH_TOKEN: ${{ github.token }}
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v4.2.2
         with:
+          ref: ${{ inputs.source-branch-name }}
           # Allows merging/pulling across branches
           fetch-depth: 0
 
@@ -44,32 +52,72 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-      - name: Create or determine branch
-        id: create_branch
-        run: |
-          if [ "${{ inputs.create-new-branch }}" = "true" ]; then
-            # Create the specified dev branch from main and exit
-            git checkout main
-            git checkout -b "${{ inputs.dev-branch-name }}"
-            git push origin "${{ inputs.dev-branch-name }}"
-            echo "create_pr=false" >> $GITHUB_OUTPUT
-          else
-            # Use main as the head branch for PR
-            echo "create_pr=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Create pull request
-        if: steps.create_branch.outputs.create_pr == 'true'
+      - name: Down-merge logic
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SOURCE: ${{ inputs.source-branch-name }}
+          TARGETS: ${{ inputs.target-branches }}
+          INCREMENT: ${{ inputs.increment-target-branch }}
         run: |
-          base="${{ inputs.dev-branch-name }}"
-          head="main"
-          title="Downmerge main -> $base"
-          body="Opening a pull request to bring main changes into $base."
+          set -e
+          # If increment flag is set, treat TARGETS as list of prefixes and compute next semver branch for each
+          if [ "$INCREMENT" = "true" ]; then
+            echo "Increment mode enabled – will create next semver branch for each prefix in '$TARGETS'"
+            NEW_TARGETS=""
+            for prefix in $TARGETS; do
+              echo "Processing prefix: $prefix"
+              # find latest branch with this prefix
+              latest=$(git ls-remote --heads origin "refs/heads/${prefix}*" | awk '{print $2}' | sed -E "s#refs/heads/${prefix}##" | sort -t'.' -k1,1V -k2,2V -k3,3V | tail -n1)
+              if [ -z "$latest" ]; then
+                echo "No existing branches found for prefix '$prefix'; skipping."
+                continue
+              fi
+              IFS='.' read -r major minor patch <<< "$latest"
+              patch=$((patch+1))
+              new_branch="${prefix}${major}.${minor}.${patch}"
+              echo "Next branch for prefix '$prefix' will be $new_branch"
+              # Prevent duplicates
+              if [[ " $NEW_TARGETS " == *" $new_branch "* ]]; then
+                echo "Duplicate branch $new_branch detected – skipping duplicate entry."
+              else
+                NEW_TARGETS="$NEW_TARGETS $new_branch"
+              fi
+            done
+            TARGETS=$(echo "$NEW_TARGETS" | tr ' ' '\n' | sort -u | xargs) # trim whitespace & dedupe
+            if [ -z "$TARGETS" ]; then
+              echo "No new branches were generated. Exiting workflow."
+              exit 0
+            fi
+            echo "Computed TARGETS: $TARGETS"
+          fi
 
-          gh pr create \
-            --base "$base" \
-            --head "$head" \
-            --title "$title" \
-            --body "$body"
+          for base in $TARGETS; do
+            if ! git ls-remote --heads origin "$base" | grep -q "$base"; then
+              if [ "$INCREMENT" = "true" ]; then
+                echo "Creating new branch '$base' from '$SOURCE' (increment mode)"
+                git checkout "$SOURCE"
+                git checkout -b "$base"
+                git push origin "$base"
+                continue
+              else
+                echo "Target branch '$base' does not exist and increment mode is off – skipping."
+                continue
+              fi
+            fi
+            # PR workflow (branch exists)
+            # Skip creating PR if branches point to same commit
+            if [ "$(git rev-parse $SOURCE)" = "$(git rev-parse origin/$base)" ]; then
+              echo "No changes between $SOURCE and $base – skipping PR."
+              continue
+            fi
+            echo "Creating PR from $SOURCE into $base"
+            # skip if open PR already exists
+            if gh pr list --base "$base" --head "$SOURCE" --state open --json number -q '.[0]' | grep -q '[0-9]'; then
+              echo "PR already exists for $base – skipping."
+              continue
+            fi
+            gh pr create \
+              --base "$base" \
+              --head "$SOURCE" \
+              --title "Downmerge \`$SOURCE\` -> \`$base\`" \
+              --body "Automatically bringing changes from \`$SOURCE\` into \`$base\`." || true
+          done