Skip to content

👷 QD-17036 Add backport workflow for release branches - #1138

Merged
Ivan Efimov (ivanovec) merged 2 commits into
mainfrom
backport-workflow
Nov 13, 2026
Merged

Ivan Efimov (ivanovec) merged 2 commits into
mainfrom
backport-workflow

Conversation

@ivanovec

@ivanovec Ivan Efimov (ivanovec) commented Nov 12, 2026 •

Copy link
Copy Markdown
Collaborator

Pull Request Details

Description

Adds .github/workflows/backport.yml based on korthout/backport-action (pinned to v5.0.0 by SHA).

How to use:

  • Add a backport 261 / backport 262 / backport 263 label to a PR (several can be added at once), before or after it is merged. Works for already merged PRs too.
  • To retry a backport, remove the label and add it again.

For each target branch the action cherry-picks the merged commits (-x, squash/rebase/merge detected automatically) into backport-<pr>-to-<branch> and opens a PR titled <original title> (<branch>), assigned to the original author. On a conflict it comments on the original PR with instructions for a manual cherry-pick.

Details:

  • PRs are created with a qodana-release-bot App token (GH_APP_ID / GH_APP_PRIVATE_KEY, already used by post-release.yml), not GITHUB_TOKEN, so the required checks run on backport PRs. Approval rules are unchanged.
  • On labeled, only the newly added label is backported, so adding a second label doesn't retry the first one.
  • Backports run only after the PR is merged, so the change is reviewed in main first.
  • The workflow only needs to live on main: pull_request_target uses the PR's base branch.

Related Issue

QD-17036

Motivation and Context

All changes to main and release branches go through approved PRs, and fixes are backported by hand to 261/262/263 (e.g. QD-16607, QD-15581, QD-16860, QD-15746). GitHub has no UI cherry-pick, so this automates it.

After merge (repo settings):

  1. Create labels backport 261, backport 262, backport 263.
  2. From December 2, 2026 GitHub blocks pull_request_target on public repositories unless an Actions policy allows it: add a policy for .github/workflows/backport.yml allowing pull_request_target.

How Has This Been Tested

  • actionlint 1.7.12: clean.
  • Not run end to end yet: pull_request_target workflows only run from the default branch. First check after merge: label a merged PR with backport 263 and verify the App token is issued for qodana-cli and checks start on the backport PR.

Types of changes

  • Docs change / refactoring / dependency upgrade
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Label a merged PR with 'backport <branch>' (before or after merging) or comment
/backport to open cherry-pick PRs into release branches. PRs are created by
qodana-release-bot, so required checks run and approval is still needed.
@ivanovec
Ivan Efimov (ivanovec) requested a review from a team as a code owner November 12, 2026 10:42
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 12, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-12T10:43:45.344054Z 3c24f27 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Nov 12, 2026 •

Copy link
Copy Markdown

Qodana for Go

127 new problems were found

Inspection name Severity Problems
Vulnerable declared dependency 🔴 Failure 2
Check GO source code coverage 🔶 Warning 67
Unhandled error 🔶 Warning 13
Interprocedural potential nil dereference 🔶 Warning 10
Deprecated element 🔶 Warning 4
Imported package name as a name identifier 🔶 Warning 3
Vulnerable declared dependency 🔶 Warning 2
Reserved word used as name 🔶 Warning 1
Potential resource leak 🔶 Warning 1
Missing 'case' statements for 'iota' consts in 'switch' 🔶 Warning 1
Unsorted imports ◽️ Notice 9
Name starts with a package name ◽️ Notice 8
Empty slice declared using a literal ◽️ Notice 3
Vulnerable declared dependency ◽️ Notice 1
Redundant type conversion ◽️ Notice 1
Comment of exported element starts with the incorrect name ◽️ Notice 1
@@ Code coverage @@
+ 65% total lines covered
10631 lines analyzed, 6980 lines covered
# Calculated according to the filters of your coverage tool

☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

Comment thread .github/workflows/backport.yml Resolved
Comment thread .github/workflows/backport.yml Resolved
@ivanovec Ivan Efimov (ivanovec) changed the title 👷 Add backport workflow for release branches 👷 QD-17036 Add backport workflow for release branches Nov 13, 2026
@ivanovec
Ivan Efimov (ivanovec) merged commit 2fb260b into main Nov 13, 2026
15 checks passed
@ivanovec
Ivan Efimov (ivanovec) deleted the backport-workflow branch November 13, 2026 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants