backport-pr.yml

name: Backport PR
on:
  pull_request:
    types:
      - closed
      - labeled

jobs:
  get-backport-targets:
    name: Get backport targets
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged
    outputs:
      targets: ${{ steps.get-targets.outputs.targets }}
    steps:
      - name: Get backport targets
        id: get-targets
        env:
          EVENT_ACTION: ${{ github.event.action }}
          EVENT_LABEL_NAME: ${{ github.event.label.name }}
          PR_LABEL_NAMES_JSON: ${{ toJson(github.event.pull_request.labels.*.name) }}
        run: |
          # For 'labeled' event, use just the added label
          # For 'closed' event, use all backport labels
          if [[ "$EVENT_ACTION" == "labeled" ]]; then
            if [[ "$EVENT_LABEL_NAME" =~ ^backport/([0-9]+\.[0-9]+\.x|main)$ ]]; then
              targets=$(jq -cn --arg label "$EVENT_LABEL_NAME" '[$label]')
              echo "targets=$targets" >> "$GITHUB_OUTPUT"
            else
              echo "targets=[]" >> "$GITHUB_OUTPUT"
            fi
          else
            # Extract all well-formed backport/* labels as JSON array
            targets=$(jq -c '[.[] | select(test("^backport/([0-9]+\\.[0-9]+\\.x|main)$"))]' <<< "$PR_LABEL_NAMES_JSON")
            echo "targets=$targets" >> "$GITHUB_OUTPUT"
          fi

  backport:
    name: Backport PR to ${{ matrix.target }}
    needs: get-backport-targets
    if: needs.get-backport-targets.outputs.targets != '[]' && needs.get-backport-targets.outputs.targets != ''
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJson(needs.get-backport-targets.outputs.targets) }}
    permissions:
      id-token: write # This is required for getting the required OIDC token from GitHub
      contents: write # This is required for pushing the backport branch
      pull-requests: write # This is required for creating the backport PR
    steps:
      - name: Compute target branch
        id: target
        env:
          MATRIX_TARGET: ${{ matrix.target }}
        run: |
          target="$MATRIX_TARGET"
          target_branch="${target/backport\//}"
          echo "target_branch=$target_branch" >> "$GITHUB_OUTPUT"

      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        id: octo-sts
        with:
          scope: DataDog/datadog-agent
          policy: self.backport-pr.create-pr
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0 # needed to get the full history of the PR

      - name: Install dda
        uses: ./.github/actions/install-dda
        with:
          features: github

      - name: Run cherry-pick script
        id: cherry-pick
        continue-on-error: true
        env:
            GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
            GITHUB_EVENT_PATH: ${{ github.event_path }}
        run: dda gh cherry-pick-pr --target-branch "${{ steps.target.outputs.target_branch }}"

      - name: Comment on backport failure
        if: steps.cherry-pick.outcome == 'failure'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          TARGET_BRANCH: ${{ steps.target.outputs.target_branch }}
          MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        with:
          github-token: ${{ steps.octo-sts.outputs.token }}
          script: |
            const targetBranch = process.env.TARGET_BRANCH;
            const mergeCommitSHA = process.env.MERGE_COMMIT_SHA;
            const runUrl = process.env.RUN_URL;
            const commentBody = `⚠️ Automatic backport to \`${targetBranch}\` failed.

            This usually happens when the cherry-pick has merge conflicts and needs manual resolution.

            To backport manually, run:
            \`\`\`bash
            git fetch
            git worktree add .worktrees/backport-${targetBranch} ${targetBranch}
            cd .worktrees/backport-${targetBranch}
            git switch --create backport-${context.payload.pull_request.number}-to-${targetBranch}
            git cherry-pick -x --mainline 1 ${mergeCommitSHA}
            git push --set-upstream origin backport-${context.payload.pull_request.number}-to-${targetBranch}
            \`\`\`

            Workflow logs: ${runUrl}`;

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: commentBody,
            });

      - name: Fail workflow when cherry-pick failed
        if: steps.cherry-pick.outcome == 'failure'
        run: exit 1

      - name: Reset cherry-pick
        if: steps.cherry-pick.outputs.base != ''
        run: git reset HEAD~1

      - name: Create pull request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        if: steps.cherry-pick.outputs.base != ''
        with:
          token: ${{ steps.octo-sts.outputs.token }}
          base: ${{ steps.cherry-pick.outputs.base }}
          branch: backport-${{steps.cherry-pick.outputs.original_pr_number}}-to-${{steps.cherry-pick.outputs.base}}
          sign-commits: true
          title: "[Backport ${{steps.cherry-pick.outputs.base}}]  ${{steps.cherry-pick.outputs.original_title}}"
          body: |
            Backport ${{steps.cherry-pick.outputs.merge_commit_sha}} from #${{steps.cherry-pick.outputs.original_pr_number}}.

             ___

            ${{ steps.cherry-pick.outputs.original_body }}

          labels: ${{ steps.cherry-pick.outputs.original_labels }},backport,bot
          commit-message: |
            ${{ steps.cherry-pick.outputs.message }}

            ___

            Co-authored-by: ${{ steps.cherry-pick.outputs.author }}