You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@lucene.apache.org by "ayagmar (via GitHub)" <gi...@apache.org> on 2026/03/24 15:54:58 UTC
[PR] fix(workflows): run backport in base repo context [lucene]
ayagmar opened a new pull request, #15865:
URL: https://github.com/apache/lucene/pull/15865
### Description
Follow-up for the backport workflow.
Switches the trigger from pull_request to pull_request_target and checks out the base branch ref explicitly. The dry-run behavior looked correct, however the execution needs base-repo context so GitHub Actions can push the backport branch and open the PR for cross-repo merges ( forks )
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "ayagmar (via GitHub)" <gi...@apache.org>.
ayagmar commented on PR #15865:
URL: https://github.com/apache/lucene/pull/15865#issuecomment-4120400720
> > Hmm do you have any recommendations?
> > I can trigger the backport on push to main instead of pr events, would you prefer this?
>
> I don't have any specific recommendations, but too many open source projects are getting hacked via `pull_request_target`, so i think we really need to avoid opening up a vector for trouble here.
>
> push to main sounds much better!!
I agree and sorry about that haha, I've also been seeing the pwns and it's getting scary
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "ayagmar (via GitHub)" <gi...@apache.org>.
ayagmar commented on PR #15865:
URL: https://github.com/apache/lucene/pull/15865#issuecomment-4128675498
> We're still dry-running though, so this would be safe to test, right?
Yes. With dry-run on, this only plans and prints what it would do. It does not push a backport branch or open a backport PR.
> It feels like there's quite a few changes here besides changing the action trigger
That's true, and it's mainly because `push` does not have the PR context that `pull_request` had. We lose the PR number, labels, milestone, title, and merge SHA, so the workflow has to resolve pushed commits back to their merged PRs before it can decide whether to backport.
We also dropped the cherry-pick action. That action is built around PR-triggered context and points forked-repo usage toward `pull_request_target`, which we don't want here! Therefore On `push`, the backport step had to become explicit.
I do agree the first version was fatter than it should have been. I used LLMs while reviewing the changes, and some defensive branches slipped in that didn’t really justify themselves..
At this point, the parts I think are actually necessary are:
- walk the full pushed commit range
- resolve each merged PR from those commits
- use that PR metadata to decide targets
- perform the backport explicitly from the push context
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "rmuir (via GitHub)" <gi...@apache.org>.
rmuir commented on code in PR #15865:
URL: https://github.com/apache/lucene/pull/15865#discussion_r2982987379
##########
.github/workflows/backport.yml:
##########
@@ -1,7 +1,8 @@
name: Backport PR
on:
- pull_request:
+ # The workflow runs after merge in the base repository context.
+ pull_request_target: # zizmor: ignore[dangerous-triggers]
Review Comment:
Please no
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "ayagmar (via GitHub)" <gi...@apache.org>.
ayagmar commented on PR #15865:
URL: https://github.com/apache/lucene/pull/15865#issuecomment-4120697978
Done i did the changes
Also tested it again on my a demo repo with labels + milestone + no-op on normal prs
<img width="945" height="644" alt="image" src="https://github.com/user-attachments/assets/34769f2f-af04-4071-abb4-b62892bd8267" />
<img width="646" height="189" alt="image" src="https://github.com/user-attachments/assets/afcbaf00-5aa7-45b3-ab06-317ebf9c401d" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "rmuir (via GitHub)" <gi...@apache.org>.
rmuir commented on PR #15865:
URL: https://github.com/apache/lucene/pull/15865#issuecomment-4128300767
To me this looks rewritten by LLM. I know it's all the rage, but I think we should avoid this for the ci. Can we please clean up after the llm and make minimal logic for this project? Many of the conditionals aren't even relevant
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #15865:
URL: https://github.com/apache/lucene/pull/15865#issuecomment-4210628718
This PR has not had activity in the past 2 weeks, labeling it as stale. If the PR is waiting for review, notify the dev@lucene.apache.org list. Thank you for your contribution!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "rmuir (via GitHub)" <gi...@apache.org>.
rmuir commented on PR #15865:
URL: https://github.com/apache/lucene/pull/15865#issuecomment-4120373614
> Hmm do you have any recommendations?
> I can trigger the backport on push to main instead of pr events, would you prefer this?
I don't have any specific recommendations, but too many open source projects are getting hacked via `pull_request_target`, so i think we really need to avoid opening up a vector for trouble here.
push to main sounds much better!!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
Re: [PR] fix(workflows): run backport in base repo context [lucene]
Posted by "ayagmar (via GitHub)" <gi...@apache.org>.
ayagmar commented on PR #15865:
URL: https://github.com/apache/lucene/pull/15865#issuecomment-4120338475
> We will need to find a more secure method than pull_request_target
Hmm do you have any recommendations?
I can trigger the backport on push to main instead of pr events, would you prefer this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org