-
Notifications
You must be signed in to change notification settings - Fork 567
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
167 changed files
with
7,872 additions
and
650 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| # Copyright (c) Microsoft Corporation. | ||
| # Licensed under the MIT License. | ||
|
|
||
| # This action cherry-picks CVE fix commits from fast-track branches to corresponding | ||
| # development branches for each version of Mariner. By default, the workflow is run | ||
| # whenever a CVE fix PR to a fast-track branch is merged. Additional target branches | ||
| # for cherry-pick can be specified by adding a comment to the original PR with the | ||
| # following syntax: | ||
| # /cherry-pick <target-branch-1> <target-branch-2> | ||
| # Note the list of target branches is space-separated, and the commenter must be a | ||
| # member or owner of the repository for the action to work. | ||
| # After cherry-pick succeeds for a branch, a new PR will be created to merge the commit | ||
| # to that target branch, and a label will be added to the original PR to indicate that | ||
| # the commit has been cherry-picked to that branch. | ||
| name: Cherry pick commits from PR | ||
| on: | ||
| pull_request: | ||
| types: | ||
| - closed | ||
| branches: | ||
| - 'fasttrack/*' | ||
|
|
||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| defaults: | ||
| run: | ||
| shell: bash | ||
|
|
||
| env: | ||
| CHERRY_PICK_BRANCH_MAPPING: '{"fasttrack/2.0": "main"}' | ||
|
|
||
| jobs: | ||
| # Scans the PR for cherry pick comments, in addition to the default cherry pick target | ||
| collect_target_branches: | ||
| if: github.event.pull_request.merged == true | ||
| runs-on: ubuntu-latest | ||
| name: Collect target branches from Pull Request | ||
| outputs: | ||
| cherry_pick_target_branches: ${{ steps.target_branches.outputs.cherry_pick_target_branches }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| steps: | ||
| # Collect target branches in a list. The list includes: | ||
| # - default target branch | ||
| # - any branch specified in PR comments with the syntax | ||
| # /cherry-pick <branch-1> <branch-2> | ||
| # The final list will only contain unique branches. | ||
| # The jq filter does the following from a JSON list of comments | ||
| # [{"author": "a", "authorAssociation": "MEMBER", "body": "hello"}, | ||
| # {"author": "c", "authorAssociation": "CONTRIBUTOR", "body": "hi"}, | ||
| # {"author": "a", "authorAssociation": "MEMBER", "body": "/cherry-pick a b c"}, | ||
| # {"author": "b", "authorAssociation": "MEMBER", "body": "/cherry-pick a b"}] | ||
| # - Select only comments where the author is a member or owner of the repository | ||
| # - Collect all comments body to a list of string | ||
| # - Select only comments that starts with "/cherry-pick " | ||
| # - Remove the "/cherry-pick " prefix from each comment | ||
| # ["a b c", "a b"] | ||
| # - Split the remaining content of each comment by whitespace into a list | ||
| # [["a", "b", "c"], ["a", "b"]] | ||
| # - Flatten the list | ||
| # ["a", "b", "c", "a", "b"] | ||
| # - Add the default target branch to the list | ||
| # ["a", "b", "c", "a", "b", "default-target"] | ||
| # - Remove all duplicate values | ||
| # ["a", "b", "c", "default-target"] | ||
| - name: Create list of target branches | ||
| id: target_branches | ||
| run: | | ||
| cherry_pick_branches_json=$(gh pr view ${{ github.event.number }} \ | ||
| --repo ${{ github.repository }} \ | ||
| --json comments \ | ||
| --jq '.comments | ||
| | map(select(.authorAssociation == "MEMBER" or .authorAssociation == "OWNER") | ||
| | .body | ||
| | select(startswith("/cherry-pick ")) | ||
| | ltrimstr("/cherry-pick ") | ||
| | split(" ")) | ||
| | flatten | ||
| | . += ["${{ fromJSON(env.CHERRY_PICK_BRANCH_MAPPING)[github.base_ref] }}"] | ||
| | unique') | ||
| branches_list=$(echo $cherry_pick_branches_json | jq -r @sh | tr -d "'") | ||
| echo "cherry_pick_target_branches=$branches_list" >> $GITHUB_OUTPUT | ||
| # Actual cherry-pick work for each target branch | ||
| cherry_pick_commit: | ||
| needs: collect_target_branches | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| name: Cherry pick | ||
| steps: | ||
| - name: Workflow trigger checkout | ||
| uses: actions/checkout@v3 | ||
| with: | ||
| ref: ${{ github.base_ref }} | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Configure local git repo | ||
| run: | | ||
| git config --local user.email "[email protected]" | ||
| git config --local user.name "CBL-Mariner Servicing Account" | ||
| # Run cherry-pick for each target branch and create new PR for it. If cherry-pick fails, | ||
| # output conflicts to the action logs and notify in the original PR. We want to run the | ||
| # cherry-pick script for all target branch, even if one fails. This step will succeed if | ||
| # all cherry-picks succeed. | ||
| - name: Run cherry-pick action | ||
| run: | | ||
| cp toolkit/scripts/cherry_pick.sh ${{ runner.temp }}/cherry_pick.sh | ||
| for target_branch in ${{ needs.collect_target_branches.outputs.cherry_pick_target_branches }}; do | ||
| if ! ${{ runner.temp }}/cherry_pick.sh \ | ||
| -r "${{ github.repository }}" \ | ||
| -p "${{ github.event.pull_request.number }}" \ | ||
| -t "$target_branch" \ | ||
| -w $RUN_URL; then | ||
| failed=1 | ||
| fi | ||
| echo "================================================================================" | ||
| done | ||
| if [[ $failed == 1 ]]; then | ||
| echo "Cherry-pick failed for at least 1 target branch" | ||
| exit 1 | ||
| fi | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,6 @@ | ||
| # Copyright (c) Microsoft Corporation. | ||
| # Licensed under the MIT License. | ||
|
|
||
| trigger: none | ||
|
|
||
| variables: | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.