mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 22:13:18 +09:00
Myasnikov Daniil
c12dcdddb4
Backports were asked for pull request by pull request with labels and opened by a bot, so whether a fix reached a release line depended on someone remembering to ask, and the lines drifted apart. The policy page states the rules instead: a fix or security fix merged into main goes to every line the batch runs for, unless it is breaking, touches platform migrations or a CRD, or changes the API in a way the API review gate calls sizeable. Two labels let a maintainer override the rules for one pull request. The task pages give a maintainer the steps for a deferred conflict and for a failed batch CI. The backports route in AGENTS.md, the contributing and changelog guides and the PR template point at the policy, and the commit format lists the security type the policy takes. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Backport tasks
The backport batch is built by backport-batch, and two steps around it need a maintainer's judgement. Each is a task with fixed inputs, one allowed output and a check in code that the result passes before anything is pushed. Both wait on the batch pull request: the batch's comment lists the deferred conflicts, and a failed batch CI shows on its checks.
| Task | Input | Output | Check |
|---|---|---|---|
| Resolve a conflict | a deferred conflict on the batch pull request | the original's commits picked under one merge on the batch branch, or one pick for a squash | backport-batch fold, and backport-batch verify in CI |
| Attribute a failed batch CI | the failing jobs of the batch pull request | the culprit deferred to the next batch | backport-batch run --defer |
Rules for every task
- Push nothing but the branch of the open batch pull request,
backport-batch/<line>-<yyyymmdd>in this repository, and only what the task's check accepted. Never push tomainor arelease-*branch, and never open a second batch pull request: the scheduled run continues the open one. - Change no file the original pull request does not change. A conflict that cannot be resolved inside those files is not resolved: the original stays deferred.
- Never rewrite the batch branch by hand. A plain push to it is a fast-forward; only
backport-batch run --defer --pushreplaces it, leased on the head it rebuilt. - Leave the batch pull request's title and body to the tool: it rewrites both on every run, and a hand edit is lost or, inside the
backport-batchblock, makescheckrefuse the body. - When the task cannot be done within these rules, push nothing and leave a comment on the batch pull request saying why, so the next maintainer to look finds it. Nothing is lost by waiting: a red batch does not merge, and a deferred original goes to the next batch.
Getting the tool
Build it from main, in a clean worktree of this repository whose origin is this repository and with gh authenticated as someone who can push to the batch branch:
git fetch origin
git worktree add --detach ../backport-task origin/main
cd ../backport-task
go build -o /tmp/backport-batch ./cmd/backport-batch
Run it from that worktree. Every command but notify fetches origin first, and run, check, fold and lines read the policy from origin/main.