ci: support release label backport workflows

.github/scripts/prepare-backport-checkout.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+target_branch="${1:?target branch is required}"
+commit_range="${2:?commit range is required}"
+workspace_branch="ci-backport-${target_branch//\//-}"
+
+git fetch --no-tags origin "${target_branch}"
+git config user.name "github-actions[bot]"
+git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+if [[ "${commit_range}" != *..* ]]; then
+  echo "Invalid commit range: ${commit_range}" >&2
+  exit 1
+fi
+start_sha="${commit_range%..*}"
+end_sha="${commit_range##*..}"
+
+if [[ -z "$(git rev-list -n 1 "${commit_range}")" ]]; then
+  echo "No commits found in range ${commit_range}" >&2
+  exit 1
+fi
+
+# Build a single squash commit whose parent is the range start and whose tree
+# matches the range end. Cherry-picking this squash onto the release branch
+# applies the cumulative diff in one 3-way merge, which avoids spurious
+# conflicts when intermediate commits in the range happen to overlap with
+# changes already present (under different SHAs) on the release branch.
+end_tree="$(git rev-parse "${end_sha}^{tree}")"
+squash_sha="$(git commit-tree -p "${start_sha}" -m "ci: squashed backport of ${commit_range}" "${end_tree}")"
+
+git checkout -B "${workspace_branch}" "origin/${target_branch}"
+git cherry-pick -x "${squash_sha}"

.github/workflows/direct-backport-push.yml

@@ -0,0 +1,169 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Direct Backport Push
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: read
+
+jobs:
+  discover:
+    name: Discover direct backport targets
+    runs-on: ubuntu-latest
+    outputs:
+      pr_number: ${{ steps.discover.outputs.pr_number }}
+      targets: ${{ steps.discover.outputs.targets }}
+      has_targets: ${{ steps.discover.outputs.has_targets }}
+    steps:
+      - name: Resolve merged PR and green targets
+        id: discover
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const sha = context.sha;
+            const { owner, repo } = context.repo;
+
+            const response = await github.request(
+              "GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls",
+              {
+                owner,
+                repo,
+                commit_sha: sha,
+              }
+            );
+
+            const pullRequest = response.data.find((pr) => pr.merge_commit_sha === sha) ?? response.data[0];
+            if (!pullRequest) {
+              core.info(`No merged pull request is associated with ${sha}.`);
+              core.setOutput("pr_number", "");
+              core.setOutput("targets", "[]");
+              core.setOutput("has_targets", "false");
+              return;
+            }
+
+            const requestedTargets = [...new Set(
+              pullRequest.labels
+                .map((label) => label.name)
+                .filter((name) => /^release\/.+$/.test(name))
+            )].sort();
+
+            if (requestedTargets.length === 0) {
+              core.info(`PR #${pullRequest.number} does not request any backports.`);
+              core.setOutput("pr_number", String(pullRequest.number));
+              core.setOutput("targets", "[]");
+              core.setOutput("has_targets", "false");
+              return;
+            }
+
+            const buildRuns = await github.paginate(
+              github.rest.actions.listWorkflowRuns,
+              {
+                owner,
+                repo,
+                workflow_id: "github-action-build.yml",
+                head_sha: pullRequest.head.sha,
+                per_page: 100,
+              }
+            );
+
+            let greenTargets = [];
+            if (buildRuns.length === 0) {
+              core.warning(`No Build workflow runs found for ${pullRequest.head.sha}.`);
+            } else {
+              const allJobs = [];
+              for (const run of buildRuns) {
+                const jobs = await github.paginate(
+                  github.rest.actions.listJobsForWorkflowRun,
+                  {
+                    owner,
+                    repo,
+                    run_id: run.id,
+                    per_page: 100,
+                  }
+                );
+                allJobs.push(...jobs);
+              }
+
+              greenTargets = requestedTargets.filter((target) => {
+                const prefix = `backport (${target}) / `;
+                const targetJobs = allJobs.filter((job) => job.name.startsWith(prefix));
+                return targetJobs.length > 0 && targetJobs.every((job) => job.conclusion === "success");
+              });
+            }
+
+            const skippedTargets = requestedTargets.filter((target) => !greenTargets.includes(target));
+            if (skippedTargets.length > 0) {
+              core.warning(`Skipping targets without a successful Backport run: ${skippedTargets.join(", ")}`);
+            }
+
+            core.setOutput("pr_number", String(pullRequest.number));
+            core.setOutput("targets", JSON.stringify(greenTargets));
+            core.setOutput("has_targets", greenTargets.length > 0 ? "true" : "false");
+
+  push-backports:
+    needs: discover
+    if: ${{ needs.discover.outputs.has_targets == 'true' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: ${{ fromJson(needs.discover.outputs.targets) }}
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Cherry-pick merge commit onto target branch
+        env:
+          MERGE_SHA: ${{ github.sha }}
+          TARGET_BRANCH: ${{ matrix.target }}
+          PR_NUMBER: ${{ needs.discover.outputs.pr_number }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          parent_count=$(git rev-list --parents -n 1 "${MERGE_SHA}" | awk '{print NF-1}')
+          if [[ "${parent_count}" -ne 1 ]]; then
+            echo "Direct backport expects a squash-merged commit on main. ${MERGE_SHA} has ${parent_count} parents." >&2
+            exit 1
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          pr_title=$(gh pr view "${PR_NUMBER}" --json title --jq .title)
+          pr_body=$(gh pr view "${PR_NUMBER}" --json body --jq .body)
+
+          git fetch --no-tags origin "${TARGET_BRANCH}"
+          git checkout -B "${TARGET_BRANCH}" "origin/${TARGET_BRANCH}"
+          git cherry-pick --no-commit "${MERGE_SHA}"
+
+          {
+            printf '%s (#%s)\n\n' "${pr_title}" "${PR_NUMBER}"
+            if [[ -n "${pr_body}" ]]; then
+              printf '%s\n\n' "${pr_body}"
+            fi
+            printf '(cherry picked from commit %s)\n' "${MERGE_SHA}"
+          } | git commit -F -
+
+          git push origin "HEAD:${TARGET_BRANCH}"

.github/workflows/github-action-build.yml

@@ -27,14 +27,105 @@ on:
       - 'main'
       - 'release/**'
   pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
   workflow_dispatch:
 
+permissions:
+  checks: write
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
+  # Precheck decides which downstream jobs run for this event:
+  #   - run_frontend / run_scala / run_python / run_agent_service: gate the
+  #     main build stacks. All true today; placeholder for future path- or
+  #     label-based selection.
+  #   - backport_targets: JSON array of release/* labels currently on the PR.
+  #     Drives the backport matrix; empty array means no backport runs.
+  precheck:
+    name: Precheck
+    runs-on: ubuntu-latest
+    outputs:
+      run_frontend: ${{ steps.decide.outputs.run_frontend }}
+      run_scala: ${{ steps.decide.outputs.run_scala }}
+      run_python: ${{ steps.decide.outputs.run_python }}
+      run_agent_service: ${{ steps.decide.outputs.run_agent_service }}
+      backport_targets: ${{ steps.decide.outputs.backport_targets }}
+    steps:
+      - name: Decide which jobs to run
+        id: decide
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const eventName = context.eventName;
+
+            // Main build stacks: always run.
+            const stacks = ["run_frontend", "run_scala", "run_python", "run_agent_service"];
+            for (const key of stacks) {
+              core.setOutput(key, "true");
+            }
+
+            // Backport targets: all current release/* labels on the PR.
+            let targets = [];
+            if (eventName === "pull_request") {
+              const labels = context.payload.pull_request.labels.map((l) => l.name);
+              targets = [...new Set(labels.filter((n) => /^release\/.+$/.test(n)))].sort();
+            }
+
+            if (targets.length === 0) {
+              core.info(`No backport targets on PR.`);
+            } else {
+              core.info(`Backport targets: ${targets.join(", ")}`);
+            }
+            core.setOutput("backport_targets", JSON.stringify(targets));
+
+  cleanup-stale-backport:
+    if: ${{ github.event_name == 'pull_request' && github.event.action == 'unlabeled' && startsWith(github.event.label.name, 'release/') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cancel obsolete backport check_runs for the removed target
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const target = context.payload.label.name;
+            const headSha = context.payload.pull_request.head.sha;
+            const prefix = `backport (${target}) `;
+
+            const checks = await github.paginate(
+              github.rest.checks.listForRef,
+              { owner, repo, ref: headSha, per_page: 100 }
+            );
+
+            for (const check of checks) {
+              if (!check.name.startsWith(prefix)) continue;
+              if (check.status === "completed" && check.conclusion === "cancelled") continue;
+              try {
+                await github.rest.checks.update({
+                  owner,
+                  repo,
+                  check_run_id: check.id,
+                  status: "completed",
+                  conclusion: "cancelled",
+                });
+                core.info(`Cancelled check ${check.name}`);
+              } catch (e) {
+                core.warning(`Failed to update check ${check.id} (${check.name}): ${e.message}`);
+              }
+            }
+
   frontend:
+    needs: precheck
+    if: ${{ needs.precheck.outputs.run_frontend == 'true' }}
     name: frontend (${{ matrix.os }}, 18)
     runs-on: ${{ matrix.os }}
     strategy:
@@ -83,6 +174,8 @@ jobs:
         run: yarn --cwd frontend run test:ci
 
   scala:
+    needs: precheck
+    if: ${{ needs.precheck.outputs.run_scala == 'true' }}
     strategy:
       matrix:
         os: [ ubuntu-22.04 ]
@@ -189,6 +282,8 @@ jobs:
         run: sbt test
 
   python:
+    needs: precheck
+    if: ${{ needs.precheck.outputs.run_python == 'true' }}
     strategy:
       matrix:
         os: [ ubuntu-latest ]
@@ -228,6 +323,8 @@ jobs:
           cd amber/src/main/python && pytest -sv
 
   agent-service:
+    needs: precheck
+    if: ${{ needs.precheck.outputs.run_agent_service == 'true' }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -262,3 +359,22 @@ jobs:
         run: bun run typecheck
       - name: Run unit tests
         run: bun test
+
+  backport:
+    needs: precheck
+    if: ${{ needs.precheck.outputs.backport_targets != '[]' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        target: ${{ fromJson(needs.precheck.outputs.backport_targets) }}
+    uses: ./.github/workflows/reusable-build.yml
+    with:
+      checkout_ref: refs/pull/${{ github.event.pull_request.number }}/head
+      backport_target_branch: ${{ matrix.target }}
+      backport_commit_range: ${{ format('{0}..{1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) }}
+      job_name_suffix: ""
+      run_frontend: true
+      run_scala: true
+      run_python: true
+      run_agent_service: true
+    secrets: inherit