Skip to content

Adds signoff to backport workflow #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JoshVanL wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Adds signoff to backport workflow #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/backport.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,20 @@ jobs:
- uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e
with:
github_token: ${{ secrets.dapr_bot_token }}
- uses: actions/checkout@v4
with:
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout is using the default GITHUB_TOKEN, but this reusable workflow sets permissions: {} and the later git push will therefore run without a token that can write to origin. As a result, the force-push is very likely to fail. Pass ${{ secrets.dapr_bot_token }} to actions/checkout (and keep credentials persisted) or otherwise configure git credentials so that pushes authenticate with the bot token.

Suggested change
with:
with:
token: ${{ secrets.dapr_bot_token }}
persist-credentials: true

Copilot uses AI. Check for mistakes.
fetch-depth: 2
- name: Add DCO signoff to backport commits
run: |
PR_NUMBER="${{ github.event.pull_request.number }}"
for BRANCH in $(git ls-remote --heads origin | grep "backport-${PR_NUMBER}-to-" | awk '{print $2}' | sed 's|refs/heads/||'); do
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The branch discovery pipeline uses grep with a regular expression; using a fixed-string match (grep -F) (or anchoring the pattern) would avoid any accidental regex interpretation and make the intent clearer when matching backport-${PR_NUMBER}-to-... branch names.

Suggested change
for BRANCH in $(git ls-remote --heads origin | grep "backport-${PR_NUMBER}-to-" | awk '{print $2}' | sed 's|refs/heads/||'); do
for BRANCH in $(git ls-remote --heads origin | grep -F "backport-${PR_NUMBER}-to-" | awk '{print $2}' | sed 's|refs/heads/||'); do

Copilot uses AI. Check for mistakes.
git fetch origin "${BRANCH}"
git checkout "${BRANCH}"
AUTHOR_NAME=$(git log -1 --format='%an')
AUTHOR_EMAIL=$(git log -1 --format='%ae')
git -c user.name="${AUTHOR_NAME}" -c user.email="${AUTHOR_EMAIL}" commit --amend --signoff --no-edit
Comment on lines +54 to +56
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This only amends HEAD, so if the backport branch contains multiple commits (e.g., a rebase-merged PR with several commits), only the last commit gets a DCO signoff and earlier commits remain unsigned. If the intent is to ensure DCO compliance for the whole backport, update the workflow to add signoffs to all commits on the backport branch (for example by rebasing with signoff or otherwise rewriting each commit), then force-push once.

Suggested change
AUTHOR_NAME=$(git log -1 --format='%an')
AUTHOR_EMAIL=$(git log -1 --format='%ae')
git -c user.name="${AUTHOR_NAME}" -c user.email="${AUTHOR_EMAIL}" commit --amend --signoff --no-edit
TARGET_BRANCH="${BRANCH#backport-${PR_NUMBER}-to-}"
git fetch origin "${TARGET_BRANCH}"
AUTHOR_NAME=$(git log -1 --format='%an')
AUTHOR_EMAIL=$(git log -1 --format='%ae')
GIT_COMMITTER_NAME="${AUTHOR_NAME}" GIT_COMMITTER_EMAIL="${AUTHOR_EMAIL}" git rebase --signoff "origin/${TARGET_BRANCH}"

Copilot uses AI. Check for mistakes.
git push --force-with-lease origin "${BRANCH}"
done

delete-branch:
name: Delete backport branch
Expand Down
Loading