backport.yml

name: Create backport pull requests

on:
  pull_request_target:
    types: [closed]
    branches: [main]
  issue_comment:
    types: [created]

permissions:
  contents: read
  issues: read
  pull-requests: read

concurrency:
  group: backport-${{ github.event.issue.number || github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  add-backport-label:
    name: Add backport label from comment
    if: >-
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request != null &&
      github.event.issue.state == 'open' &&
      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
    permissions:
      contents: read
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Add requested release label
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        with:
          script: |
            const command =
              /(?:^|\n)\s*\/backport\s+(release-(?:(?:[2-9]|[1-9]\d+)\.\d+|1\.(?:9|10)))\s*$/gm;
            const labels = [...context.payload.comment.body.matchAll(command)].map(
              match => `backport-${match[1]}`,
            );
            const uniqueLabels = [...new Set(labels)];

            if (uniqueLabels.length === 0) {
              core.info('No backport command found in the comment.');
              return;
            }

            for (const label of uniqueLabels) {
              try {
                await github.rest.issues.createLabel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  name: label,
                  color: '1D76DB',
                  description: 'Release line requested for an automated backport',
                });
              } catch (error) {
                if (error.status !== 422) {
                  throw error;
                }
              }
            }

            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: uniqueLabels,
            });
            core.info(`Added labels: ${uniqueLabels.join(', ')}`);

  backport:
    name: Backport merged pull request
    if: github.event.pull_request.merged == true && github.repository == 'redhat-developer/rhdh-plugins'
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Create backport pull requests
        env:
          GH_TOKEN: ${{ secrets.RHDH_BOT_TOKEN }}
          EVENT_PATH: ${{ github.event_path }}
        run: |
          set -euo pipefail

          pr_number=$(jq -r '.pull_request.number' "$EVENT_PATH")
          pr_title=$(jq -r '.pull_request.title' "$EVENT_PATH")
          pr_url=$(jq -r '.pull_request.html_url' "$EVENT_PATH")

          source_commits=()
          while IFS= read -r source_commit; do
            source_commits+=("$source_commit")
          done < <(
            gh api --paginate \
              "repos/$GITHUB_REPOSITORY/pulls/$pr_number/commits" \
              --jq '.[].sha'
          )

          if [[ ${#source_commits[@]} -eq 0 ]]; then
            echo "No commits found for pull request #$pr_number." >&2
            exit 1
          fi

          release_lines=()
          while IFS= read -r release_line; do
            release_lines+=("$release_line")
          done < <(
            jq -r '.pull_request.labels[].name' "$EVENT_PATH" \
              | grep -E '^backport-release-((([2-9]|[1-9][0-9]+)\.[0-9]+)|(1\.(9|10)))$' \
              | sed 's/^backport-//' \
              | sort -u
          )

          if [[ ${#release_lines[@]} -eq 0 ]]; then
            echo 'No backport-release labels found; nothing to do.'
            exit 0
          fi

          if [[ ${#release_lines[@]} -ne 1 ]]; then
            echo 'Exactly one backport-release label is required per request.' >&2
            exit 1
          fi

          release_line="${release_lines[0]}"
          target_branch="$release_line"

          if [[ "$release_line" == release-1.9 || "$release_line" == release-1.10 ]]; then
            workspace_labels=()
            while IFS= read -r workspace; do
              workspace_labels+=("$workspace")
            done < <(
              jq -r '.pull_request.labels[].name' "$EVENT_PATH" \
                | sed -n 's/^workspace\/\([A-Za-z0-9._-]*\)$/\1/p' \
                | sort -u
            )

            if [[ ${#workspace_labels[@]} -ne 1 ]]; then
              echo "Exactly one workspace label is required for legacy release '$release_line'." >&2
              exit 1
            fi

            target_branch="$release_line/${workspace_labels[0]}"
          fi

          git config user.name 'rhdh-bot'
          git config user.email 'rhdh-bot@redhat.com'
          git fetch origin --prune

          process_target() {
            local backport_branch="backport/${pr_number}-to-${target_branch}"
            local backport_label="backport-${target_branch%%/*}"
            local body_file=''

            cleanup_branch() {
              rm -f "$body_file"

              if ! git ls-remote --exit-code origin "refs/heads/$backport_branch" >/dev/null; then
                return 0
              fi

              local existing_pr
              if ! existing_pr=$(gh pr list \
                --repo "$GITHUB_REPOSITORY" \
                --head "$backport_branch" \
                --base "$target_branch" \
                --state all \
                --json number \
                --jq '.[0].number // empty'); then
                echo "Unable to determine whether backport PR exists for '$backport_branch'; preserving the branch." >&2
                return 1
              fi

              if [[ -n "$existing_pr" ]]; then
                echo "Backport PR #$existing_pr exists; preserving branch '$backport_branch'." >&2
                return 0
              fi

              echo "Removing orphaned backport branch '$backport_branch'." >&2
              git push origin --delete "$backport_branch"
            }

            if ! git ls-remote --exit-code origin "refs/heads/$target_branch" >/dev/null; then
              echo "Release branch '$target_branch' does not exist; skipping." >&2
              return 0
            fi

            if git ls-remote --exit-code origin "refs/heads/$backport_branch" >/dev/null; then
              existing_pr=$(gh pr list \
                --repo "$GITHUB_REPOSITORY" \
                --head "$backport_branch" \
                --base "$target_branch" \
                --state all \
                --json number \
                --jq '.[0].number // empty')
              if [[ -n "$existing_pr" ]]; then
                echo "Backport PR #$existing_pr already exists for '$target_branch'; skipping."
                return 0
              fi
              echo "Branch '$backport_branch' already exists without a backport PR; refusing to overwrite." >&2
              return 1
            fi

            if ! git switch --detach "origin/$target_branch" || \
              ! git switch --create "$backport_branch"; then
              return 1
            fi

            for source_commit in "${source_commits[@]}"; do
              if ! git fetch origin "$source_commit"; then
                cleanup_branch
                return 1
              fi

              parent_count=$(git rev-list --parents -n 1 "$source_commit" | wc -w | tr -d ' ')
              if [[ "$parent_count" -gt 2 ]]; then
                if ! git cherry-pick -m 1 "$source_commit"; then
                  git cherry-pick --abort || true
                  cleanup_branch
                  return 1
                fi
              elif ! git cherry-pick "$source_commit"; then
                git cherry-pick --abort || true
                cleanup_branch
                return 1
              fi
            done

            if ! git push --set-upstream origin "$backport_branch"; then
              cleanup_branch || true
              return 1
            fi

            body_file=$(mktemp)
            printf 'This pull request backports [#%s](%s) to `%s`.\n\nPlease resolve any conflicts and complete the normal review before merging.\n' \
              "$pr_number" \
              "$pr_url" \
              "$target_branch" > "$body_file"

            if ! gh pr create \
              --repo "$GITHUB_REPOSITORY" \
              --base "$target_branch" \
              --head "$backport_branch" \
              --title "Backport #${pr_number}: ${pr_title}" \
              --body-file "$body_file" \
              --label "$backport_label"; then
              cleanup_branch || true
              return 1
            fi

            rm -f "$body_file"
            git switch --detach "origin/main"
            git branch --delete --force "$backport_branch"
          }

          if ! process_target; then
            echo "Backport target '$target_branch' failed." >&2
            exit 1
          fi