action.yml

name: "lekko-push"
description: "Push changes to Lekko"
branding:
  icon: arrow-up-right
  color: purple
inputs:
  api_key:
    description: Lekko API key for the team/repository.
    required: true
  project_path:
    description: Path to a project that uses lekko (contains a .lekko file)
    default: .
  team_name:
    description: Lekko team name. Uses the GitHub organization name by default. Only required if your Lekko team name is different from your GitHub organization name.
    required: false
  staging:
    description: Whether to connect to Lekko's staging environment. For internal use only.
    required: false
    default: false
  dev_api_key:
    description: Alternative Lekko developer API key. For internal use only.
    required: false
runs:
  using: composite
  steps:
    - name: Set up Buf
      uses: bufbuild/buf-setup-action@v1.31.0
      with:
        github_token: ${{ github.token }}
    - name: Set up Lekko
      uses: lekkodev/lekko-setup-action@v1
      with:
        apikey: ${{ inputs.dev_api_key != '' && inputs.dev_api_key || inputs.api_key }}
        version: latest
    # TODO: Cache token (1 hour expiry)
    - name: Get GitHub installation access token
      id: get_token
      shell: bash
      run: |
        export API_KEY="${{ inputs.api_key }}"
        export STAGING="${{ inputs.staging }}"
        export OWNER_NAME="${{ github.event.repository.owner.login }}"
        export REPO_NAME="${{ github.event.repository.name }}"
        export TEAM_NAME="${{ inputs.team_name != '' && inputs.team_name || github.event.repository.owner.login }}"
        export PROJECT_PATH="${{ inputs.project_path }}"
        ${GITHUB_ACTION_PATH}/get_token.sh
    # We re-checkout the code repo using the Lekko-issued token for git remove permissions available to the app (e.g. write)
    - name: Re-checkout with token
      uses: actions/checkout@v4
      with:
        # We need to fetch all commits, otherwise we run into "corrupted" git errors when trying to check out specific commits
        fetch-depth: 0
        clean: false
        token: ${{ steps.get_token.outputs.token }}
    # For a fix PR, we want to treat the generated commit (which pulls Lekko changes) as base
    # Note that the associated fix branch may be deleted at this point, but that's fine
    - name: Get push event base
      id: get_push_base
      if: github.event_name == 'push'
      shell: bash {0}
      run: |
        PR_INFO="$(gh pr list --search "${{ github.event.head_commit.id }}" --state merged --json commits,headRefName,mergedBy,number,url --jq '.[0]')"
        if [[ ! -z "$PR_INFO" ]]; then
          echo "Pull request push info: $PR_INFO"
          echo "pr_url="$(echo "$PR_INFO" | jq '.url' --raw-output)"" >> $GITHUB_OUTPUT
          echo "pr_number="$(echo "$PR_INFO" | jq '.number' --raw-output)"" >> $GITHUB_OUTPUT
          BRANCH="$(echo "$PR_INFO" | jq '.headRefName' --raw-output)"
          echo "Pull request push branch: $BRANCH"
          if [[ "$BRANCH" == lekko-fix-* || "$BRANCH" == lekko-to-code-* ]]; then
            echo "This push event is associated with a Lekko fix PR"
            BASE_SHA="$(echo "$PR_INFO" | jq '.commits[0].oid' --raw-output)"
          else
            echo "This pull request push is not associated with a Lekko fix PR"
            BASE_SHA="${{ github.event.before }}"
          fi
          MERGED_BY_ID="$(echo "$PR_INFO" | jq '.mergedBy.id' --raw-output)"
          if [[ "$MERGED_BY_ID" != "null" && "$MERGED_BY_ID" != "" ]]; then
            MERGED_BY="$(gh api graphql \
              -F id="$MERGED_BY_ID" \
              -f query='
                query userQuery($id: ID!) {
                  node(id: $id) {
                    ... on User {
                      name
                      login
                      email
                      databaseId
                    }
                  }
                }
                ' \
              --jq '.data.node')"
            echo "$MERGED_BY"
            MERGED_BY_NAME="$(echo "$MERGED_BY" | jq '.name' --raw-output)"
            MERGED_BY_USERNAME="$(echo "$MERGED_BY" | jq '.login' --raw-output)"
            MERGED_BY_EMAIL="$(echo "$MERGED_BY" | jq '.email' --raw-output)"
            if [[ -z "$MERGED_BY_EMAIL" ]]; then
              MERGED_BY_EMAIL="$(echo "$MERGED_BY" | jq '.databaseId' --raw-output)+${MERGED_BY_USERNAME}@users.noreply.github.com"
            fi
            echo "Merged by: $MERGED_BY_NAME <${MERGED_BY_EMAIL}>"
            echo "merged_by_name=$MERGED_BY_NAME" >> $GITHUB_OUTPUT
            echo "merged_by_username=$MERGED_BY_USERNAME" >> $GITHUB_OUTPUT
            echo "merged_by_email=$MERGED_BY_EMAIL" >> $GITHUB_OUTPUT
          fi
        else
          echo "This push is not associated with a pull request"
          BASE_SHA="${{ github.event.before }}"
        fi
        if [[ -z "$BASE_SHA" ]]; then
          echo "Failed to determine base sha for changes"
          exit 1
        fi
        echo "Base SHA: $BASE_SHA"
        echo "base_sha=$BASE_SHA" >> $GITHUB_OUTPUT
        if [[ "$BASE_SHA" == "0000000000000000000000000000000000000000" ]]; then
          echo "Base SHA is null commit"
        else
          echo "Fetch base"
          git fetch origin $BASE_SHA
        fi
      env:
        GH_TOKEN: ${{ steps.get_token.outputs.token }}
    - name: Get pull request event base
      id: get_pr_base
      if: github.event_name == 'pull_request'
      shell: bash
      run: |
        echo "Pull request branch: ${{ github.event.pull_request.head.ref }}"
        if [[ "${{ github.event.pull_request.head.ref }}" == lekko-fix-* || "${{ github.event.pull_request.head.ref }}" == lekko-to-code-* ]]; then
          echo "This pull request event is associated with a Lekko fix PR"
          BASE_SHA="$(git rev-list ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | tail -1)"
        else
          echo "This pull request event is not associated with a Lekko fix PR"
          BASE_SHA="$(git merge-base ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }})"
        fi
        if [[ -z "$BASE_SHA" ]]; then
          echo "Failed to determine base sha for changes"
          exit 1
        fi
        echo "Base SHA: $BASE_SHA"
        echo "base_sha=$BASE_SHA" >> $GITHUB_OUTPUT
    - name: Consolidate base
      id: get_base
      shell: bash
      # Only one of the 2 outputs should be a non-empty string
      run: |
        echo "base_sha=${{ steps.get_push_base.outputs.base_sha }}${{ steps.get_pr_base.outputs.base_sha }}" >> $GITHUB_OUTPUT
        echo "merged_by_name=${{ steps.get_push_base.outputs.merged_by_name }}" >> $GITHUB_OUTPUT
        echo "merged_by_username=${{ steps.get_push_base.outputs.merged_by_username }}" >> $GITHUB_OUTPUT
        echo "merged_by_email=${{ steps.get_push_base.outputs.merged_by_email }}" >> $GITHUB_OUTPUT
        echo "pr_url=${{ steps.get_push_base.outputs.pr_url }}" >> $GITHUB_OUTPUT
        echo "pr_number=${{ steps.get_push_base.outputs.pr_number }}" >> $GITHUB_OUTPUT
    - name: Read Lekko configuration
      id: read_dot_lekko
      shell: bash
      run: |
        export PROJECT_PATH="${{ inputs.project_path }}"
        ${GITHUB_ACTION_PATH}/read_dot_lekko.sh
    - name: Read Lekko configuration at base
      id: read_dot_lekko_base
      shell: bash
      run: |
        export PROJECT_PATH="${{ inputs.project_path }}"
        ${GITHUB_ACTION_PATH}/read_dot_lekko_base.sh ${{ steps.get_base.outputs.base_sha }} ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.after }}
    - name: Checkout Lekko repo
      uses: actions/checkout@v4
      with:
        repository: ${{ steps.read_dot_lekko.outputs.repository }}
        path: _lekko
        token: ${{ steps.get_token.outputs.token }}
    # Move Lekko repo to outside of code repo (which is at $GITHUB_WORKSPACE) so that it won't interfere with git ops
    - name: Move Lekko repo
      shell: bash
      run: mv ${GITHUB_WORKSPACE}/_lekko ~/lekko
    # Check whether bisync was not run
    # If there are no changes in Lekko repo after running bisync from head, treat as special case - don't try to mirror anything
    # This is to handle cases such as if user manually ran pull
    - name: Check bisync
      id: check_bisync
      shell: bash {0}
      run: |
        echo "pre-check reset"
        git reset --hard && git clean -fd
        cd ${{ inputs.project_path }}
        if ! lekko bisync -r ~/lekko; then
          echo -e "Lekko codegen check failed.\n\nPlease run \`lekko bisync\`, fix the reported issues, and try again." > ~/info-body
        else
          if ! (git add ${{ steps.read_dot_lekko.outputs.lekko_path }} && git diff --quiet && git diff --cached --quiet); then
            echo "$(git diff --cached)"
            echo -e "Detected unchecked Lekko codegen changes.\n\nPlease run \`lekko bisync\` and commit the results." > ~/info-body
          fi
        fi
        cd ${GITHUB_WORKSPACE}
        if [[ -s ~/info-body ]] && [[ "${{ github.event_name }}" == "pull_request" ]]; then
          cat ~/info-body
          gh pr comment ${{ github.event.pull_request.number }} --edit-last --body-file ~/info-body || gh pr comment ${{ github.event.pull_request.number }} --body-file ~/info-body
          exit 1
        fi
        git reset --hard && git clean -fd
        cd ~/lekko
        if git add . && git diff --quiet && git diff --cached --quiet; then
          echo "head is equal to lekko head, diff checking will be skipped"
          echo "head_equal=true" >> $GITHUB_OUTPUT
        fi
        git reset --hard && git clean -fd
        cd ${GITHUB_WORKSPACE}
      env:
        GH_TOKEN: ${{ steps.get_token.outputs.token }}
    # Get diff from perspective of Lekko repo based on changes in code repo
    - name: Get diff
      id: get_diff
      if: steps.check_bisync.outputs.head_equal != 'true'
      shell: bash
      run: |
        export PROJECT_PATH="${{ inputs.project_path }}"
        ${GITHUB_ACTION_PATH}/get_diff.sh ${{ steps.get_base.outputs.base_sha }} ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.after }} ${{ steps.read_dot_lekko_base.outputs.new_lekko }}
      env:
        GH_TOKEN: ${{ steps.get_token.outputs.token }}
    # TODO: If a PR goes from has Lekko changes -> no changes, we should try to delete or update the comment
    - name: Comment
      id: comment
      if: github.event_name == 'pull_request' && (steps.get_diff.outputs.diff_info != '' || steps.read_dot_lekko_base.outputs.new_lekko == 'true')
      shell: bash
      run: |
        export TEAM_NAME="${{ inputs.team_name != '' && inputs.team_name || github.event.repository.owner.login }}"
        cd ${GITHUB_WORKSPACE}
        if [[ "${{ inputs.staging }}" == true ]]; then
          HOST="https://app-staging.lekko.com"
        else
          HOST="https://app.lekko.com"
        fi
        if [[ "${{ steps.read_dot_lekko_base.outputs.new_lekko }}" == true ]]; then
          echo "Congratulations, your project is now connected to Lekko! :tada:" >> ~/info-body
          echo "" >> ~/info-body
          echo "Try logging into the [web UI](https://app.lekko.com/), exploring our [docs](https://docs.lekko.com/), or making more lekko changes!" >> ~/info-body
        fi
        DIFF_INFO="${{ steps.get_diff.outputs.diff_info }}"
        if [[ ! -z "$DIFF_INFO" ]]; then
          if [[ "${{ steps.read_dot_lekko_base.outputs.new_lekko }}" == true ]]; then
            echo "" >> ~/info-body
            echo "---" >> ~/info-body
          fi
          echo "This pull request includes changes to the following lekkos:" >> ~/info-body
          echo "" >> ~/info-body
          echo "| Lekko | Status |" >> ~/info-body
          echo "| :-----| :----- |" >> ~/info-body
          while IFS= read -r LINE ; do
            N_S=(${LINE//;/ })
            case ${N_S[1]} in
              D)
                STATUS=":x: Deleted"
                RENDER_LINK=true
                ;;
              M)
                STATUS=":pencil2: Modified"
                RENDER_LINK=true
                ;;
              A)
                STATUS=":green_circle: Added"
                RENDER_LINK=false
                ;;
            esac
            if [[ $RENDER_LINK == true ]]; then
              CONFIG_SUFFIX="$(echo "${N_S[0]}" | sed 's/\//\/configs\//g' | sed 's/^/namespaces\//g')"
              echo "| [${N_S[0]}]($HOST/teams/${TEAM_NAME}/repositories/${{ steps.read_dot_lekko.outputs.repository }}/branches/main/${CONFIG_SUFFIX}) | $STATUS |" >> ~/info-body
            else
              echo "| ${N_S[0]} | $STATUS |" >> ~/info-body
            fi
          done <<< "$DIFF_INFO"
          echo "" >> ~/info-body
          echo "When this branch is merged, the changes will automatically be deployed to Lekko. You can verify your changes on your [Lekko dashboard](${HOST}/teams/${TEAM_NAME}/repositories/${{ steps.read_dot_lekko.outputs.repository }})." >> ~/info-body
        else
          if [[ "${{ steps.read_dot_lekko_base.outputs.new_lekko }}" != true ]]; then
            echo -e "This pull request does not include any changes to your lekkos." >> ~/info-body
          fi
        fi
        gh pr comment ${{ github.event.pull_request.number }} --edit-last --body-file ~/info-body || gh pr comment ${{ github.event.pull_request.number }} --body-file ~/info-body
      env:
        GH_TOKEN: ${{ steps.get_token.outputs.token }}
    # Try to apply relevant changes from this push to LR and create a PR for them
    # If creating the PR fails, we need to offer a fix
    # TODO: Figure out how to assign to correct user even if the main author is bot
    # TODO: Related to ^, figure out how to add user as coauthor of mirror commit so that webapp can display
    - name: Open Lekko PR
      id: create_pr
      if: github.event_name == 'push' && steps.get_diff.outputs.diff_info != ''
      # To not fail prematurely on intermediate errors
      shell: bash {0}
      run: |
        export TEAM_NAME="${{ inputs.team_name != '' && inputs.team_name || github.event.repository.owner.login }}"
        if [[ -z $(cat ~/lekko.patch) ]]; then
          echo "No Lekko diffs to apply"
          exit 0
        fi
        if [[ "${{ inputs.staging }}" == true ]]; then
          HOST="https://app-staging.lekko.com"
        else
          HOST="https://app.lekko.com"
        fi
        git config --global user.email "108442683+lekko-app[bot]@users.noreply.github.com"
        git config --global user.name "lekko-app[bot]"
        cd ~/lekko
        git checkout main
        BEFORE_SHORT="$(git rev-parse --short ${{ github.event.before }})"
        AFTER_SHORT="$(git rev-parse --short ${{ github.event.after }})"
        LEKKO_BRANCH=${GITHUB_REPOSITORY}-${BEFORE_SHORT}-${AFTER_SHORT}
        BRANCH_LS=$(git ls-remote --heads origin refs/heads/${LEKKO_BRANCH})
        if [[ ! -z ${BRANCH_LS} ]]; then
          echo "Branch $LEKKO_BRANCH already exists"
          exit 1
        fi
        git checkout -b $LEKKO_BRANCH
        if ! git apply ~/lekko.patch; then
          LEKKO_SHA="$(git rev-parse HEAD)"
          echo "Failed to apply patch on ${LEKKO_SHA}"
          echo "Automatic push of Lekko changes failed because this project and the live mirror are out of sync. One or more remote changes conflict with changes introduced in this repository between ${{ github.event.before }} and ${{ github.event.after }}."
          echo "Generating fix PR:"
          echo "---------------------------------------------------------------------"
          git checkout main
          cd ${GITHUB_WORKSPACE}
          git checkout ${{ steps.get_base.outputs.base_sha }}
          FIX_BRANCH=lekko-fix-${BEFORE_SHORT}-${AFTER_SHORT}
          BRANCH_LS=$(git ls-remote --heads origin refs/heads/${FIX_BRANCH})
          if [[ ! -z ${BRANCH_LS} ]]; then
            echo "Branch $FIX_BRANCH already exists"
            exit 1
          fi
          echo "Collecting diff info..."
          cd ${{ inputs.project_path }}
          lekko bisync -r ~/lekko
          cd ${GITHUB_WORKSPACE}
          git reset --hard && git clean -fd
          cd ~/lekko
          git add .
          DIFF_INFO="$(git diff --cached --binary --name-status --no-renames | grep '\.star' | sed -E 's/(^.+)\t(.*).star/\2;\1/g' | sort)"
          git reset --hard && git clean -fd
          cd ${GITHUB_WORKSPACE}
          git checkout ${{ steps.get_base.outputs.base_sha }}
          echo "Checking out new fix branch $FIX_BRANCH"
          git checkout -b $FIX_BRANCH
          cd ${{ inputs.project_path }}
          lekko gen -r ~/lekko
          git add ${{ steps.read_dot_lekko.outputs.lekko_path }}
          cd ${GITHUB_WORKSPACE}
          FIX_MESSAGE="Pull from ${{ steps.read_dot_lekko.outputs.repository }}@$(git rev-parse --short ${LEKKO_SHA})"
          git commit -m "$FIX_MESSAGE"
          git push -u origin $FIX_BRANCH
          echo "This pull request brings in the latest values of your [lekkos](${HOST}/teams/${TEAM_NAME}/repositories/${{ steps.read_dot_lekko.outputs.repository }})." >> ~/fix-body
          echo "" >> ~/fix-body
          echo "It was generated because [Run #${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) encountered a conflict while attempting to automatically push changes." >> ~/fix-body
          echo "" >> ~/fix-body
          echo "The local code for the following lekkos will be updated:" >> ~/fix-body
          echo "" >> ~/fix-body
          echo "| Lekko | Status |" >> ~/fix-body
          echo "| :---- | :----- |" >> ~/fix-body
          while IFS= read -r LINE ; do
            N_S=(${LINE//;/ })
            case ${N_S[1]} in
              A)
                STATUS=":x: Deleted"
                RENDER_LINK=false
                ;;
              M)
                STATUS=":pencil2: Modified"
                RENDER_LINK=true
                ;;
              D)
                STATUS=":green_circle: Added"
                RENDER_LINK=true
                ;;
            esac
            if [[ $RENDER_LINK == true ]]; then
              CONFIG_SUFFIX="$(echo "${N_S[0]}" | sed 's/\//\/configs\//g' | sed 's/^/namespaces\//g')"
              echo "| [${N_S[0]}]($HOST/teams/${TEAM_NAME}/repositories/${{ steps.read_dot_lekko.outputs.repository }}/branches/main/${CONFIG_SUFFIX}) | $STATUS |" >> ~/fix-body
            else
              echo "| ${N_S[0]} | $STATUS |" >> ~/fix-body
            fi
          done <<< "$DIFF_INFO"
          echo "---" >> ~/fix-body
          echo "To resolve the conflict:" >> ~/fix-body
          echo "1. Check out this branch: \`git fetch origin && git checkout $FIX_BRANCH\`" >> ~/fix-body
          echo "2. Run \`git pull --no-rebase origin ${{ github.event.repository.default_branch }}\`" >> ~/fix-body
          echo "3. Handle the merge conflicts, make any additional changes, and then push to this PR" >> ~/fix-body
          echo "4. Merge this PR" >> ~/fix-body
          echo "---" >> ~/fix-body
          echo "Generated by Lekko :sparkles: Please do not force push or change the base/head branches of this PR." >> ~/fix-body
          PR_URL="$(gh pr create -B ${{ github.event.repository.default_branch }} -H $FIX_BRANCH --title "$FIX_MESSAGE" --body-file ~/fix-body --assignee "$([[ "${{ github.event.head_commit.author.username }}" != *\[bot\] ]] && echo "${{ github.event.head_commit.author.username }}" || echo "")")"
          if [[ $? -ne 0 ]]; then
            echo "Failed to create ${{ github.repository }} PR for branch $FIX_BRANCH"
            exit 1
          fi
          echo "A pull request to pull the latest values of lekkos was automatically created: ${PR_URL}"
          echo "Please follow the instructions on the above pull request to resolve the conflict."
          if [[ ! -z "${{ steps.get_base.outputs.pr_url }}" ]]; then
            echo ":x: Failed to automatically push Lekko changes because this project and the live mirror are out of sync. A conflict was detected." >> ~/conflict-body
            echo "" >> ~/conflict-body
            echo "A pull request to pull the latest values of lekkos was automatically created: ${PR_URL}" >> ~/conflict-body
            echo "" >> ~/conflict-body
            echo "Please follow the instructions on the above pull request to resolve the conflict." >> ~/conflict-body
            gh pr comment "${{ steps.get_base.outputs.pr_url }}" --body-file ~/conflict-body
          fi
          exit 1
        fi
        echo "Successfully applied patch"
        lekko compile
        if [[ $? -ne 0 ]]; then
          echo "Failed to compile in Lekko repository"
          exit 1
        fi
        git add .
        if [[ ! -z "${{ steps.get_base.outputs.pr_number}}" ]]; then
          TITLE="Mirror ${GITHUB_REPOSITORY}#${{ steps.get_base.outputs.pr_number}}"
        else
          TITLE="Mirror ${GITHUB_REPOSITORY}@${BEFORE_SHORT}..${AFTER_SHORT}"
        fi
        COMMIT_MSG="$TITLE"
        if [[ ! -z "${{ steps.get_base.outputs.merged_by_email }}" ]]; then
          if [[ ! -z "${{ steps.get_base.outputs.merged_by_name }}" ]]; then
            CO_AUTHOR_NAME="${{ steps.get_base.outputs.merged_by_name }}"
          elif [[ ! -z "${{ steps.get_base.outputs.merged_by_username }}" ]]; then
            CO_AUTHOR_NAME="${{ steps.get_base.outputs.merged_by_username }}"
          else
            CO_AUTHOR_NAME="${{ steps.get_base.outputs.merged_by_email }}"
          fi
          COMMIT_MSG="$COMMIT_MSG"$'\n\n'"Co-authored-by: $CO_AUTHOR_NAME <${{ steps.get_base.outputs.merged_by_email }}>"
        fi
        git commit --allow-empty -m "$COMMIT_MSG"
        git push -u origin $LEKKO_BRANCH
        echo "Successfully pushed branch $LEKKO_BRANCH"
        echo "Generated by Lekko CI [$GITHUB_REPOSITORY Run #${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" > ~/mirror-body
        if [[ ! -z "${{ steps.get_base.outputs.pr_url }}" ]]; then
          echo "Generated by Lekko CI based on ${{ steps.get_base.outputs.pr_url }}" > ~/mirror-body
        fi
        PR_URL="$(gh pr create -B main -H $LEKKO_BRANCH --title "$TITLE" --body-file ~/mirror-body)"
        if [[ $? -ne 0 ]]; then
          echo "Failed to create ${{ steps.read_dot_lekko.outputs.repository }} PR for branch $LEKKO_BRANCH, please open and merge a PR manually"
          exit 1
        fi
        echo "Successfully opened pull request to propagate changes: ${PR_URL}"
        echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
      env:
        GH_TOKEN: ${{ steps.get_token.outputs.token }}
    # Automatically merge the generated PR against LR
    - name: Merge Lekko PR
      id: merge_pr
      if: steps.create_pr.outputs.pr_url != ''
      shell: bash {0}
      # NOTE: There's a race condition - after a PR is created, `gh pr checks` might fail thinking that there are no checks on the PR
      # See: https://github.com/cli/cli/issues/7401
      run: |
        export TEAM_NAME="${{ inputs.team_name != '' && inputs.team_name || github.event.repository.owner.login }}"
        cd ~/lekko
        if [[ "${{ inputs.staging }}" == true ]]; then
          HOST="https://app-staging.lekko.com"
        else
          HOST="https://app.lekko.com"
        fi
        while :
        do
          STATUS="$(gh pr view ${{ steps.create_pr.outputs.pr_url }} --json statusCheckRollup --jq '.statusCheckRollup[0].status')"
          if [[ $? -ne 0 ]]; then
            echo "Unexpected error while checking status of ${{ steps.create_pr.outputs.pr_url }}"
            echo "Please make sure you have accepted the latest permissions for the Lekko GitHub App by going to https://github.com/organizations/${{ github.event.repository.owner.login }}/settings/installations and that the app has access to this repository"
            echo "Trying merge anyway..."
            break
          fi
          if [[ "$STATUS" == "COMPLETED" ]]; then
            echo "Checks have been completed"
            break
          else
            echo "Waiting for checks to complete..."
            sleep 5
          fi
        done
        if ! gh pr merge ${{ steps.create_pr.outputs.pr_url }} --auto --squash --delete-branch; then
          echo "Failed to automatically merge ${{ steps.create_pr.outputs.pr_url }}"
          exit 1
        fi
        echo "Successfully merged ${{ steps.create_pr.outputs.pr_url }}"
        if [[ ! -z "${{ steps.get_base.outputs.pr_url }}" ]]; then
          echo ":white_check_mark: Successfully pushed changes to Lekko! You can verify and continue making changes on your [Lekko dashboard](${HOST}/teams/${TEAM_NAME}/repositories/${{ steps.read_dot_lekko.outputs.repository }})." >> ~/success-body
          gh pr comment "${{ steps.get_base.outputs.pr_url }}" --body-file ~/success-body
        fi
      env:
        GH_TOKEN: ${{ steps.get_token.outputs.token }}