From b22483de33635db573b865ed37bd143b1553e262 Mon Sep 17 00:00:00 2001 From: bo0tzz Date: Thu, 27 Aug 2026 15:10:07 +0200 Subject: [PATCH] feat: backport pull requests to release branches (#31035) --- .github/workflows/backport.yml | 47 +++++++++++++++++++++++++++ .github/workflows/draft-release.yml | 22 +++++++++++++ .github/workflows/migration-order.yml | 15 +++++++++ .github/workflows/prepare-release.yml | 5 +++ 4 files changed, 89 insertions(+) create mode 100644 .github/workflows/backport.yml diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml new file mode 100644 index 000000000..e14f506c4 --- /dev/null +++ b/.github/workflows/backport.yml @@ -0,0 +1,47 @@ +name: Backport + +on: + pull_request_target: # zizmor: ignore[dangerous-triggers] no pull request code is checked out or executed + types: [closed, labeled] + +permissions: {} + +jobs: + backport: + name: Backport pull request + if: ${{ github.event.pull_request.merged }} + runs-on: ubuntu-latest + permissions: {} + steps: + - id: token + uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0 + with: + client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }} + private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }} + permission-contents: write + permission-pull-requests: write + + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + token: ${{ steps.token.outputs.token }} + persist-credentials: true + + - name: Create backport pull requests + uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0 + with: + github_token: ${{ steps.token.outputs.token }} + label_pattern: '^backport:(release/.+)$' + add_team_reviewers: team + auto_merge_enabled: true + auto_merge_method: squash + comment_style: summary + copy_all_reviewers: true + copy_labels_pattern: '^changelog:' + experimental: | + { + "conflict_resolution": "draft_commit_conflicts" + } + pull_title: '${pull_title}' + git_committer_name: 'immich-push-o-matic[bot]' + git_committer_email: '179150890+immich-push-o-matic[bot]@users.noreply.github.com' diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml index 78f7a57fe..319e8a4b3 100644 --- a/.github/workflows/draft-release.yml +++ b/.github/workflows/draft-release.yml @@ -54,6 +54,28 @@ jobs: echo "rc=false" >> "$GITHUB_OUTPUT" fi + - name: Checkout main + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: main + path: main + persist-credentials: false + token: ${{ steps.token.outputs.token }} + + - name: Setup Mise + uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1 + with: + github_token: ${{ steps.token.outputs.token }} + + - name: Install dependencies + run: mise //server:install + + - name: Verify the release line does not diverge from main + env: + MAIN_MIGRATIONS: ${{ github.workspace }}/main/server/src/schema/migrations + ORDER: ${{ github.workspace }}/server/src/schema/migrations/ORDER + run: mise //server:migrations verify-order --source-folder "${MAIN_MIGRATIONS}" --append-only-from "${ORDER}" + - name: Push tag env: TAG: ${{ steps.version.outputs.version }} diff --git a/.github/workflows/migration-order.yml b/.github/workflows/migration-order.yml index 9975c87e2..7cf39ae5b 100644 --- a/.github/workflows/migration-order.yml +++ b/.github/workflows/migration-order.yml @@ -21,6 +21,8 @@ jobs: env: BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }} BASELINE: ${{ github.workspace }}/base/server/src/schema/migrations/ORDER + MAIN_MIGRATIONS: ${{ github.workspace }}/main/server/src/schema/migrations + ORDER: ${{ github.workspace }}/server/src/schema/migrations/ORDER steps: - id: token uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0 @@ -53,3 +55,16 @@ jobs: - name: Verify migration ORDER run: mise //server:migrations verify-order --append-only-from "${BASELINE}" + + - name: Checkout main + if: ${{ startsWith(github.base_ref, 'release/') || startsWith(github.ref_name, 'release/') }} + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: main + path: main + persist-credentials: false + token: ${{ steps.token.outputs.token }} + + - name: Verify the release line does not diverge from main + if: ${{ startsWith(github.base_ref, 'release/') || startsWith(github.ref_name, 'release/') }} + run: mise //server:migrations verify-order --source-folder "${MAIN_MIGRATIONS}" --append-only-from "${ORDER}" diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 0fef2ac24..c0d8f2c31 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -64,6 +64,7 @@ jobs: client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }} private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }} permission-contents: write + permission-issues: write - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -101,7 +102,11 @@ jobs: - name: Cut the release branch if: ${{ github.ref_name == 'main' }} env: + GH_TOKEN: ${{ steps.token.outputs.token }} VERSION: ${{ steps.output.outputs.version }} run: | line=$(sed -E 's/^(v[0-9]+\.[0-9]+).*/\1/' <<< "${VERSION}") git push origin "HEAD:refs/heads/release/${line}" + gh label create "backport:release/${line}" --force \ + --description "Backport this pull request to release/${line}" \ + --color 5319e7