[ci] Added backport workflow#684
Merged
nemesifier merged 4 commits intoopenwisp:masterfrom Mar 2, 2026
Merged
Conversation
📝 WalkthroughWalkthroughA new GitHub Actions workflow file was added at .github/workflows/backport.yml to automate backporting fixes to stable branches. It triggers on pushes to the default branch and on issue comments that start with Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub (event)
participant Repo as Repository
participant Reusable as Reusable Backport Workflow
participant Runner as Actions Runner
GitHub->>Repo: push to default branch OR issue_comment (/backport)
Repo->>Reusable: invoke reusable backport workflow (with commit SHA or PR number + comment)
Reusable->>Runner: request runner with provided inputs & secrets
Runner->>Reusable: execute backport steps
Reusable->>Repo: create backport PR(s) / post status
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 1 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/backport.yml:
- Around line 11-13: The concurrency group currently uses github.ref which
equals the default branch for issue_comment events and serializes all
comment-triggered backport jobs; modify the concurrency group expression used in
the concurrency block (the group field) to include a PR-specific key such as
github.event.issue.number when available (falling back to github.ref) so
different PRs can run in parallel while still preventing concurrent runs for the
same PR (e.g., change the group expression to use github.event.issue.number ||
github.ref).
- Line 22: The workflow uses the reusable workflow reference
"openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@master" which
should be pinned to a stable tag or commit SHA to avoid breaking changes; update
that "uses:" reference in .github/workflows/backport.yml (and the other
occurrence noted) to a specific tag or commit (e.g., `@v1.0.0` or @<commit-sha>)
and ensure both instances are changed consistently.
- Around line 30-36: The if-condition uses
github.event.issue.pull_request.merged_at which doesn't exist on issue_comment
events so the check always fails; remove the merged_at clause from the
conditional and instead verify merge status by fetching the PR via the GitHub
API before invoking the reusable workflow (e.g., add an actions/github-script
step that calls github.rest.pulls.get with context.repo and context.issue.number
and exits if pr.data.merged is false), or alternatively switch the workflow
trigger to pull_request (action: closed) and use
github.event.pull_request.merged directly; update the existing conditional that
contains github.event.issue.pull_request, github.event.issue.state,
contains(...), and startsWith(...) accordingly.
ℹ️ Review info
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/backport.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Python==3.12 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=5.2.0
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.13 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.2.0
- GitHub Check: Python==3.10 | django~=4.2.0
nemesifier
reviewed
Mar 2, 2026
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/backport.yml (2)
21-21: 🧹 Nitpick | 🔵 TrivialPin reusable workflow reference instead of
@master.Using
@masterfor reusable workflow imports can introduce unplanned breakages from upstream changes. Pin to a tag or commit SHA in both references.Suggested fix
- uses: openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@master + uses: openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@<pinned-tag-or-sha> ... - uses: openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@master + uses: openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@<pinned-tag-or-sha>Also applies to: 36-36
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/backport.yml at line 21, The workflow uses an unpinned reusable workflow reference ("uses: openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@master"); replace the `@master` ref with a fixed tag or commit SHA (e.g., `@vX.Y.Z` or @<commit-sha>) so the import is immutable; update both occurrences of the same "uses: openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@master" line (the one shown and the one reported at the later occurrence) to the chosen pinned tag/SHA.
29-33:⚠️ Potential issue | 🔴 Critical
issue_commentmerge check is invalid and prevents the comment job from running.On Line 32,
github.event.issue.pull_request.merged_atis not present forissue_commentpayloads, so this condition fails andbackport-on-commentis effectively blocked.Suggested fix
backport-on-comment: if: > github.event_name == 'issue_comment' && github.event.issue.pull_request && - github.event.issue.pull_request.merged_at != null && github.event.issue.state == 'closed' && contains(fromJSON('["MEMBER", "OWNER"]'), github.event.comment.author_association) && startsWith(github.event.comment.body, '/backport')If you need strict “merged PR only” enforcement, add a pre-check job that fetches the PR via API and gates this job via
needs.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/backport.yml around lines 29 - 33, The current job 'backport-on-comment' uses an if condition that references github.event.issue.pull_request.merged_at which is not present on issue_comment payloads and therefore blocks the job; remove the merged_at check from the top-level if (keep github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.issue.state == 'closed') and implement a small pre-check job (e.g. verify-pr-merged) that fetches the PR via the GitHub API using the issue.pull_request.url, sets an output like merged=true/false, then make backport-on-comment depend on needs.verify-pr-merged and add a runtime guard using needs.verify-pr-merged.outputs.merged == 'true' so the workflow only runs for actually merged PRs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/backport.yml:
- Line 21: The workflow uses an unpinned reusable workflow reference ("uses:
openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@master");
replace the `@master` ref with a fixed tag or commit SHA (e.g., `@vX.Y.Z` or
@<commit-sha>) so the import is immutable; update both occurrences of the same
"uses: openwisp/openwisp-utils/.github/workflows/reusable-backport.yml@master"
line (the one shown and the one reported at the later occurrence) to the chosen
pinned tag/SHA.
- Around line 29-33: The current job 'backport-on-comment' uses an if condition
that references github.event.issue.pull_request.merged_at which is not present
on issue_comment payloads and therefore blocks the job; remove the merged_at
check from the top-level if (keep github.event_name == 'issue_comment' &&
github.event.issue.pull_request && github.event.issue.state == 'closed') and
implement a small pre-check job (e.g. verify-pr-merged) that fetches the PR via
the GitHub API using the issue.pull_request.url, sets an output like
merged=true/false, then make backport-on-comment depend on
needs.verify-pr-merged and add a runtime guard using
needs.verify-pr-merged.outputs.merged == 'true' so the workflow only runs for
actually merged PRs.
ℹ️ Review info
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/backport.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: Python==3.13 | django~=5.1.0
- GitHub Check: Python==3.12 | django~=5.2.0
- GitHub Check: Python==3.13 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=5.2.0
- GitHub Check: Python==3.12 | django~=5.1.0
- GitHub Check: Python==3.12 | django~=4.2.0
- GitHub Check: Python==3.11 | django~=5.2.0
- GitHub Check: Python==3.10 | django~=4.2.0
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.1.0
nemesifier
approved these changes
Mar 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist
Reference to Existing Issue
openwisp/openwisp-utils#501