Add backport support #131
Add backport support #131
Conversation
WalkthroughA new GitHub Actions workflow named "Backport" has been added. This workflow triggers on pull request closure or labeling events, checks conditions for merged PRs and backport labels, authenticates using a GitHub App token, and utilizes the Changes
Poem
Tip ⚡️ Faster reviews with caching
Enjoy the performance boost—your workflow just got faster. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/backport.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (6)
- GitHub Check: e2e-tests (ubuntu-24.04-arm)
- GitHub Check: e2e-tests-28d6b1cc3b49ab9ae176918ab9709a2e2522c97e
- GitHub Check: e2e-tests (ubuntu-24.04)
- GitHub Check: deploy-kind
- GitHub Check: tests
- GitHub Check: lint-go
🔇 Additional comments (7)
.github/workflows/backport.yaml (7)
1-5: Strong security warning about user input injection
Including this explicit warning at the top is excellent to prevent future expansions from accidentally exposing the GITHUB_TOKEN to untrusted code.
6-11: Appropriate trigger configuration
Usingpull_request_targetwithclosedandlabeledevents correctly scopes when backports should run. Nice work on limiting to merged PRs in the conditional.
12-16: Restricting default token permissions
Settingpermissions: {}at the workflow root and exclusively using a GitHub App token minimizes blast radius for potential abuses.Also applies to: 18-18
20-27: Using GitHub App for elevated actions
Leveragingactions/create-github-app-tokenwith a commit pin and providing only the necessary secrets ensures secure, auditable backport PR creation.
28-32: Secure checkout of pull request head
Checking out the PR’s commit explicitly with the App token prevents reliance onGITHUB_TOKENand avoids permission pitfalls.
33-42: Proper backport-action usage and configuration
Thekorthout/backport-actionis correctly pinned, with conflict handling set to draft commits, merge commits skipped, and a clear PR description template.
18-18:❓ Verification inconclusive
Verify runner image availability
Pinning toubuntu-24.04may fail if that runner isn't yet supported. Consider usingubuntu-latestor confirm that GitHub Actions supportsubuntu-24.04:
🏁 Script executed:
gh api /repos/actions/virtual-environments --jq '.images[].name'Length of output: 92
Confirm availability of
ubuntu-24.04runner
Thegh apiquery returnednull, so we couldn’t verify that this image exists. Please manually confirm that GitHub Actions supportsubuntu-24.04before pinning, or switch to a known-supported label.• .github/workflows/backport.yaml (line 18:
runs-on: ubuntu-24.04)
• Check the official runner images documentation or the actions/virtual-environments repository for available Ubuntu versions
• Ifubuntu-24.04isn’t yet supported, useubuntu-latest(orubuntu-22.04) to avoid workflow failures
| jobs: | ||
| backport: | ||
| name: Backport Pull Request | ||
| if: github.repository_owner == 'jumpstarter-dev' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name)) |
There was a problem hiding this comment.
Fix startsWith argument order
The call startsWith('backport', github.event.label.name) is reversed—it checks if 'backport' starts with the label (always false). It should be:
-if: github.repository_owner == 'jumpstarter-dev' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
+if: github.repository_owner == 'jumpstarter-dev' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith(github.event.label.name, 'backport'))This ensures that labeling with backport/... will trigger the job.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if: github.repository_owner == 'jumpstarter-dev' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name)) | |
| if: github.repository_owner == 'jumpstarter-dev' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith(github.event.label.name, 'backport')) |
Summary by CodeRabbit