ci: improve Linear release tracking for scheduled pipeline (#23357)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/linear-release.yaml

@@ -4,9 +4,7 @@ on:
   push:
     branches:
       - main
-  # This event reads the workflow from the default branch (main), not the
-  # release branch. No cherry-pick needed.
-  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
+      - "release/2.[0-9]+"
   release:
     types: [published]
 
@@ -18,9 +16,9 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  sync:
-    name: Sync issues to Linear release
-    if: github.event_name == 'push'
+  sync-main:
+    name: Sync issues to next Linear release
+    if: github.event_name == 'push' && github.ref_name == 'main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -28,18 +26,84 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Detect next release version
+        id: version
+        # Find the highest release/2.X branch (exact pattern, no suffixes like
+        # release/2.31_hotfix) and derive the next minor version for the release
+        # currently in development on main.
+        run: |
+          LATEST_MINOR=$(git branch -r | grep -E '^\s*origin/release/2\.[0-9]+$' | \
+            sed 's/.*release\/2\.//' | sort -n | tail -1)
+          if [ -z "$LATEST_MINOR" ]; then
+            echo "No release branch found, skipping sync."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "version=2.$((LATEST_MINOR + 1))" >> "$GITHUB_OUTPUT"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+
       - name: Sync issues
         id: sync
-        uses: linear/linear-release-action@5cbaabc187ceb63eee9d446e62e68e5c29a03ae8 # v0.5.0
+        if: steps.version.outputs.skip != 'true'
+        uses: linear/linear-release-action@755d50b5adb7dd42b976ee9334952745d62ceb2d # v0.6.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
+          version: ${{ steps.version.outputs.version }}
+          timeout: 300
 
-      - name: Print release URL
-        if: steps.sync.outputs.release-url
-        run: echo "Synced to $RELEASE_URL"
-        env:
-          RELEASE_URL: ${{ steps.sync.outputs.release-url }}
+  sync-release-branch:
+    name: Sync backports to Linear release
+    if: github.event_name == 'push' && startsWith(github.ref_name, 'release/')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Extract release version
+        id: version
+        # The trigger only allows exact release/2.X branch names.
+        run: |
+          echo "version=${GITHUB_REF_NAME#release/}" >> "$GITHUB_OUTPUT"
+
+      - name: Sync issues
+        id: sync
+        uses: linear/linear-release-action@755d50b5adb7dd42b976ee9334952745d62ceb2d # v0.6.0
+        with:
+          access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
+          command: sync
+          version: ${{ steps.version.outputs.version }}
+          timeout: 300
+
+  code-freeze:
+    name: Move Linear release to Code Freeze
+    needs: sync-release-branch
+    if: >
+      github.event_name == 'push' &&
+      startsWith(github.ref_name, 'release/') &&
+      github.event.created == true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Extract release version
+        id: version
+        run: |
+          echo "version=${GITHUB_REF_NAME#release/}" >> "$GITHUB_OUTPUT"
+
+      - name: Move to Code Freeze
+        id: update
+        uses: linear/linear-release-action@755d50b5adb7dd42b976ee9334952745d62ceb2d # v0.6.0
+        with:
+          access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
+          command: update
+          stage: Code Freeze
+          version: ${{ steps.version.outputs.version }}
+          timeout: 300
 
   complete:
     name: Complete Linear release
@@ -50,16 +114,29 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Extract release version
+        id: version
+        # Strip "v" prefix and patch: "v2.31.0" -> "2.31". Also detect whether
+        # this is a minor release (v*.*.0) — patch releases (v2.31.1, v2.31.2,
+        # ...) are grouped into the same Linear release and must not re-complete
+        # it after it has already shipped.
+        run: |
+          VERSION=$(echo "$TAG" | sed 's/^v//' | cut -d. -f1,2)
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.0$ ]]; then
+            echo "is_minor=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_minor=false" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+
       - name: Complete release
         id: complete
-        uses: linear/linear-release-action@5cbaabc187ceb63eee9d446e62e68e5c29a03ae8 # v0
+        if: steps.version.outputs.is_minor == 'true'
+        uses: linear/linear-release-action@755d50b5adb7dd42b976ee9334952745d62ceb2d # v0.6.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete
-          version: ${{ github.event.release.tag_name }}
-
-      - name: Print release URL
-        if: steps.complete.outputs.release-url
-        run: echo "Completed $RELEASE_URL"
-        env:
-          RELEASE_URL: ${{ steps.complete.outputs.release-url }}
+          version: ${{ steps.version.outputs.version }}
+          timeout: 300