ci: Add Gemini conflict resolution to cherry-pick

This change integrates the Gemini API into the cherry-pick workflow to
automatically resolve merge conflicts. When a cherry-pick fails, the
gemini-cli action is invoked to attempt to resolve any conflicts.
This reduces manual intervention for routine cherry-picks.

Bug: 488071229

Author: oxve

.github/workflows/label-cherry-pick.yaml

@@ -6,6 +6,9 @@ on:
       - labeled
       - closed
 
+permissions:
+  contents: read
+
 jobs:
   prepare_branch_list:
     runs-on: ubuntu-latest
@@ -35,10 +38,10 @@ jobs:
         branches=("main" "26.eap" "26.android" "25.lts.1+" "24.lts.1+" "23.lts.1+" "22.lts.1+" "21.lts.1+" "20.lts.1+" "19.lts.1+" "rc_11" "COBALT_9")
         filtered_branches=()
         for branch in "${branches[@]}"; do
-          if [[ $branch == $BASE_REF ]]; then
+          if [[ $branch == ${BASE_REF} ]]; then
             continue
           fi
-          if [[ ${labels[@]} =~ "cp-$branch" ]]; then
+          if [[ "$labels" =~ "cp-$branch" ]]; then
             filtered_branches+=("$branch")
           fi
         done
@@ -48,18 +51,14 @@ jobs:
   cherry_pick:
     runs-on: ubuntu-latest
     permissions:
+      contents: write
+      pull-requests: write
       issues: write
     needs: prepare_branch_list
     if: needs.prepare_branch_list.outputs.target_branch != '[]'
     strategy:
       matrix:
         target_branch: ${{ fromJson(needs.prepare_branch_list.outputs.target_branch) }}
-    env:
-      ACCESS_TOKEN: ${{ secrets.CHERRY_PICK_TOKEN }}
-      REPOSITORY: ${{ github.repository }}
-      GITHUB_REF: ${{ github.ref }}
-      MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
-      CHERRY_PICK_BRANCH: cherry-pick-${{ matrix.target_branch }}-${{ github.event.pull_request.number }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -78,33 +77,71 @@ jobs:
       - name: Cherry pick merge commit
         id: cherry-pick
         continue-on-error: true
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_ACTIONS_API_KEY }}
+          MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
         run: |
           set -x
-          git fetch origin ${{ matrix.target_branch }}
-
           set +e
           # Select the first parent as the mainline tree. This is necessary if
           # the commit has multiple parents as the cherry-pick will fail otherwise.
           git cherry-pick -x --mainline=1 ${MERGE_COMMIT_SHA}
           RES=$?
           set -e
+          conflicts=""
           if [ ${RES} -ne 0 ]; then
-            # If the cherry pick failed due to a merge conflict we can
-            # add the conflicting file and create the commit anyway.
-            git add .
-            git cherry-pick --continue
+            conflicts=$(git diff --name-only --diff-filter=U)
+            if [ -n "${conflicts}" ]; then
+              # Stage and commit the changes (with conflicts) before Gemini touches them.
+              git add .
+              git commit -C ${MERGE_COMMIT_SHA} --no-verify
+            fi
           fi
+          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+          echo "conflicts<<$EOF" >> $GITHUB_OUTPUT
+          echo "$conflicts" >> $GITHUB_OUTPUT
+          echo "$EOF" >> $GITHUB_OUTPUT
           exit ${RES}
 
+      - name: Resolve Merge Conflicts with Gemini CLI
+        if: steps.cherry-pick.outputs.conflicts != ''
+        uses: google-github-actions/run-gemini-cli@v0
+        with:
+          gemini_api_key: ${{ secrets.GEMINI_ACTIONS_API_KEY }}
+          prompt: |
+            You are an expert software engineer dealing with a failed cherry pick.
+            The most recent commit has the conflicts committed.
+            Once the conflicts are resolved you must leave the files unstaged.
+            Analyze what it's trying to achieve and fix the conflicts.
+            Leave the files with the fixed conflicts unstaged.
+            Files with conflicts:
+            ${{ steps.cherry-pick.outputs.conflicts }}
+
+      - name: Commit Resolution
+        id: commit-resolution
+        continue-on-error: true
+        env:
+          CONFLICTS: ${{ steps.cherry-pick.outputs.conflicts }}
+        run: |
+          set -x
+          if [ -n "${CONFLICTS}" ]; then
+            git add -u
+            git commit -m "Conflicts resolved by Gemini"
+            # Only output commit sha if commit succeeded.
+            if [[ $? == 0 ]]; then
+              echo "gemini_commit_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+            fi
+          fi
+
       - name: Create Pull Request
         id: create-pr
         continue-on-error: true
         uses: peter-evans/create-pull-request@2b011faafdcbc9ceb11414d64d0573f37c774b04 # v4.2.3
         with:
-          token: ${{ secrets.CHERRY_PICK_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           draft: ${{ steps.cherry-pick.outcome == 'failure' }}
           base: ${{ matrix.target_branch }}
-          branch: ${{ env.CHERRY_PICK_BRANCH }}
+          branch: cherry-pick-${{ matrix.target_branch }}-${{ github.event.pull_request.number }}
           committer: GitHub Release Automation <github@google.com>
           reviewers: |
             ${{ github.event.pull_request.user.login }}
@@ -117,23 +154,39 @@ jobs:
 
       - name: Comment on failure
         uses: actions/github-script@v8
+        env:
+          REPOSITORY: ${{ github.repository }}
+          NEW_PR_NUMBER: ${{ steps.create-pr.outputs.pull-request-number }}
+          CHERRY_PICK_OUTCOME: ${{ steps.cherry-pick.outcome }}
+          GEMINI_COMMIT_SHA: ${{ steps.commit-resolution.outputs.gemini_commit_sha }}
+          CHERRY_PICK_BRANCH: cherry-pick-${{ matrix.target_branch }}-${{ github.event.pull_request.number }}
         with:
-          github-token: ${{ secrets.CHERRY_PICK_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            if ('${{ steps.create-pr.outputs.pull-request-number }}' == '') {
+            const { NEW_PR_NUMBER, CHERRY_PICK_OUTCOME, REPOSITORY, CHERRY_PICK_BRANCH, GEMINI_COMMIT_SHA } = process.env;
+            const logFooter = `Check the log at ${context.serverUrl}/${REPOSITORY}/actions/runs/${context.runId} for details.`;
+            if (NEW_PR_NUMBER == '') {
               // Comment on the originating PR if creating a cherry pick PR failed.
               github.rest.issues.createComment({
                 issue_number: context.payload.number,
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                body: '> [!CAUTION]\n> Creating the cherry pick PR failed! Check the log at ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} for details.'
+                body: `> [!CAUTION]\n> Creating the cherry pick PR failed!\n\n${logFooter}`
               });
-            } else if ('${{ steps.cherry-pick.outcome }}' == 'failure') {
+            } else if (CHERRY_PICK_OUTCOME == 'failure') {
               // Comment on the new PR if the cherry pick failed.
+              const cautionHeader = '> [!CAUTION]\n> There were merge conflicts while cherry picking!';
+              let geminiNotice;
+              if (GEMINI_COMMIT_SHA) {
+                geminiNotice = `\n\nGemini has attempted to fix the conflicts in [this commit](${context.serverUrl}/${REPOSITORY}/pull/${NEW_PR_NUMBER}/commits/${GEMINI_COMMIT_SHA}). Please review carefully before merging.`;
+              } else {
+                geminiNotice = '';
+              }
+              const checkoutInstructions = `To checkout the cherry-pick branch, run:\n\`\`\`\ngit fetch origin ${CHERRY_PICK_BRANCH}; git checkout FETCH_HEAD\n\`\`\``;
               github.rest.issues.createComment({
-                issue_number: '${{ steps.create-pr.outputs.pull-request-number }}',
+                issue_number: parseInt(NEW_PR_NUMBER),
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                body: '![MERGE CONFLICT CAT](https://services.google.com/fh/files/misc/merge_conflict_cat.png)\n> [!CAUTION]\n> There were merge conflicts while cherry picking! Check out [${{ env.CHERRY_PICK_BRANCH }}](${{ github.repository }}/tree/${{ env.CHERRY_PICK_BRANCH }}) and fix the conflicts before proceeding. Check the log at ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} for details.'
+                body: `![MERGE CONFLICT CAT](https://services.google.com/fh/files/misc/merge_conflict_cat.png)\n${cautionHeader}${geminiNotice}\n\n${checkoutInstructions}\n\n${logFooter}`
               });
             }