Harden closed PR branch cleanup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mrecachinas

.github/workflows/delete_staging_and_head_branches_writer.yaml

@@ -1,169 +0,0 @@
-name: Delete PR staging and head branches writer
-
-on:
-  workflow_run:
-    workflows: ["Delete PR staging and head branches"]
-    types: [completed]
-  schedule:
-    - cron: "5-55/10 * * * *"
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: Pull request number to process
-        required: true
-        type: number
-
-permissions:
-  contents: write
-  pull-requests: read
-
-jobs:
-  delete-staging-and-head-branches:
-    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete staging and head branches
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPOSITORY: ${{ github.repository }}
-          WORKFLOW_RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
-          DISPATCH_PR_NUMBER: ${{ inputs.pr_number }}
-        run: |
-          set -euo pipefail
-
-          is_pr_number() {
-            [[ "$1" =~ ^[0-9]+$ ]]
-          }
-
-          is_staging_branch_for_pr() {
-            local branch="$1"
-            local pr_number="$2"
-            local prefix suffix
-
-            is_pr_number "${pr_number}" || return 1
-            git check-ref-format "refs/heads/${branch}" >/dev/null || return 1
-
-            suffix="/advisory-improvement-${pr_number}"
-            [[ "${branch}" == *"${suffix}" ]] || return 1
-            prefix="${branch%"${suffix}"}"
-            [[ -n "${prefix}" && "${prefix}" != */* ]]
-          }
-
-          is_deletable_branch() {
-            local branch="$1"
-            [[ -n "${branch}" && "${branch}" != "main" ]] || return 1
-            git check-ref-format "refs/heads/${branch}" >/dev/null
-          }
-
-          encode_ref() {
-            jq -rn --arg value "$1" '$value | @uri'
-          }
-
-          delete_branch() {
-            local branch="$1"
-            local encoded_branch
-
-            encoded_branch="$(encode_ref "${branch}")"
-            if gh api -X DELETE "repos/${REPOSITORY}/git/refs/heads/${encoded_branch}" --silent; then
-              echo "Deleted branch ${branch}."
-            elif gh api "repos/${REPOSITORY}/git/ref/heads/${encoded_branch}" --silent >/dev/null 2>&1; then
-              echo "::error::Failed to delete existing branch ${branch}."
-              return 1
-            else
-              echo "Branch ${branch} is already absent."
-            fi
-          }
-
-          process_pr() {
-            local advisory_file_pages base_ref base_repo expected_staging_branch head_ref head_repo
-            local pr_json pr_number="$1" state
-            expected_staging_branch="${2:-}"
-
-            if ! is_pr_number "${pr_number}"; then
-              echo "::error::Unexpected pull request number: ${pr_number}"
-              return 1
-            fi
-
-            pr_json="$(gh api "repos/${REPOSITORY}/pulls/${pr_number}")"
-            state="$(jq -r '.state' <<<"${pr_json}")"
-            base_ref="$(jq -r '.base.ref' <<<"${pr_json}")"
-            base_repo="$(jq -r '.base.repo.full_name' <<<"${pr_json}")"
-            head_ref="$(jq -r '.head.ref // empty' <<<"${pr_json}")"
-            head_repo="$(jq -r '.head.repo.full_name // empty' <<<"${pr_json}")"
-
-            if [[ "${state}" != "closed" ]]; then
-              echo "Pull request ${pr_number} is ${state}, not closed; skipping."
-              return 0
-            fi
-
-            if [[ "${base_repo}" != "${REPOSITORY}" ]]; then
-              echo "Pull request ${pr_number} targets ${base_repo}, not ${REPOSITORY}; skipping."
-              return 0
-            fi
-
-            if [[ -n "${expected_staging_branch}" && "${base_ref}" != "${expected_staging_branch}" ]]; then
-              echo "Pull request ${pr_number} no longer targets ${expected_staging_branch}; skipping."
-              return 0
-            fi
-
-            if ! is_staging_branch_for_pr "${base_ref}" "${pr_number}"; then
-              echo "Pull request ${pr_number} base branch ${base_ref} is not its advisory improvement branch; skipping."
-              return 0
-            fi
-
-            if [[ "${head_repo}" != "${REPOSITORY}" ]]; then
-              echo "Pull request ${pr_number} head repo is ${head_repo}, not ${REPOSITORY}; skipping."
-              return 0
-            fi
-
-            advisory_file_pages="$(gh api --paginate "repos/${REPOSITORY}/pulls/${pr_number}/files?per_page=100" \
-              --jq 'any(.[]; .filename | startswith("advisories/"))')"
-            if ! grep -qx 'true' <<<"${advisory_file_pages}"; then
-              echo "Pull request ${pr_number} does not modify advisories/; skipping."
-              return 0
-            fi
-
-            delete_branch "${base_ref}"
-            if [[ "${head_ref}" == "${base_ref}" ]]; then
-              return 0
-            fi
-
-            if ! is_deletable_branch "${head_ref}"; then
-              echo "Head branch ${head_ref} is not a valid deletable Git branch; leaving it in place."
-              return 0
-            fi
-
-            delete_branch "${head_ref}"
-          }
-
-          collect_reconciliation_targets() {
-            local branch branches
-
-            branches="$(gh api --paginate "repos/${REPOSITORY}/branches?per_page=100" --jq '.[].name')"
-            while IFS= read -r branch; do
-              if [[ "${branch}" =~ ^[^/]+/advisory-improvement-([0-9]+)$ ]] &&
-                 git check-ref-format "refs/heads/${branch}" >/dev/null; then
-                printf '%s\t%s\n' "${BASH_REMATCH[1]}" "${branch}"
-              fi
-            done <<<"${branches}"
-          }
-
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then
-            PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}"
-            if ! is_pr_number "${PR_NUMBER:-}"; then
-              echo "No pull request number was provided; skipping."
-              exit 0
-            fi
-            process_pr "${PR_NUMBER}"
-          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
-            process_pr "${DISPATCH_PR_NUMBER}"
-          else
-            TARGETS="$(collect_reconciliation_targets)"
-            if [[ -z "${TARGETS}" ]]; then
-              echo "No staging branches need reconciliation."
-              exit 0
-            fi
-            while IFS=$'\t' read -r PR_NUMBER STAGING_BRANCH; do
-              process_pr "${PR_NUMBER}" "${STAGING_BRANCH}"
-            done <<<"${TARGETS}"
-          fi