refactor progress

.github/workflows/promote-canary-to-main.yaml

@@ -25,13 +25,13 @@ permissions:
 
 jobs:
   promote:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    timeout-minutes: 10
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 25
 
     steps:
       - name: Create GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.PROMOTE_APP_ID }}
           private-key: ${{ secrets.PROMOTE_APP_PRIVATE_KEY }}
@@ -45,49 +45,23 @@ jobs:
 
       - name: Verify ff-only + summarize
         id: verify
-        run: |
-          set -euo pipefail
-          src="${{ inputs.src }}"
-          dst="${{ inputs.dst }}"
-
-          git fetch origin "${dst}" "${src}" --prune
-
-          # Ensure HEAD is exactly origin/src
-          git reset --hard "origin/${src}"
-
-          # FF-only requirement: dst must be an ancestor of src
-          if ! git merge-base --is-ancestor "origin/${dst}" "origin/${src}"; then
-            echo "::error::Cannot fast-forward: origin/${dst} is not an ancestor of origin/${src} (branches diverged)."
-            exit 1
-          fi
-
-          ahead="$(git rev-list --count "origin/${dst}..origin/${src}")"
-          echo "ahead=$ahead" >> "$GITHUB_OUTPUT"
-
-          {
-            echo "## Promote \`${src}\` → \`${dst}\` (ff-only)"
-            echo ""
-            echo "- \`${dst}\`: \`$(git rev-parse "origin/${dst}")\`"
-            echo "- \`${src}\`: \`$(git rev-parse "origin/${src}")\`"
-            echo "- Commits to promote: **${ahead}**"
-            echo ""
-            echo "### Commits"
-            if [ "$ahead" -eq 0 ]; then
-              echo "_Nothing to promote._"
-            else
-              git log --oneline --decorate "origin/${dst}..origin/${src}"
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
+        run: >-
+          python3 scripts/ci/workflows/promote_canary_to_main.py
+          --step verify
+          --src "${{ inputs.src }}"
+          --dst "${{ inputs.dst }}"
 
       - name: Push fast-forward
         if: ${{ steps.verify.outputs.ahead != '0' && inputs.dry_run != true }}
-        run: |
-          set -euo pipefail
-          dst="${{ inputs.dst }}"
-          # Push src HEAD to dst (no merge commit, same SHAs)
-          git push origin "HEAD:refs/heads/${dst}"
+        run: >-
+          python3 scripts/ci/workflows/promote_canary_to_main.py
+          --step push
+          --dst "${{ inputs.dst }}"
 
       - name: Dry run / no-op
         if: ${{ steps.verify.outputs.ahead == '0' || inputs.dry_run == true }}
-        run: |
-          echo "No push performed (dry_run=${{ inputs.dry_run }}, ahead=${{ steps.verify.outputs.ahead }})."
+        run: >-
+          python3 scripts/ci/workflows/promote_canary_to_main.py
+          --step dry_run
+          --dry-run "${{ inputs.dry_run }}"
+          --ahead "${{ steps.verify.outputs.ahead }}"