fix: cherry-pick the landedCommitSha for security releases

Sometimes we need to include a commit that already
landed on `main` in a security release

Author: RafaelGSS

lib/cherry_pick.js

@@ -93,6 +93,12 @@ export default class CherryPick {
     }, false, cli);
     this.expectedCommitShas =
       metadata.data.commits.map(({ commit }) => commit.oid);
+    // In security releases the fix may have already landed publicly, so the
+    // PR is merged and refs/pull/<prid>/merge no longer exists - pick the
+    // commits as they landed on the base branch instead.
+    this.landedCommitSha = metadata.data.pr.merged
+      ? metadata.data.pr.mergeCommit?.oid
+      : undefined;
 
     if (this.promptAmend) {
       const amend = await cli.prompt(

lib/landing_session.js

@@ -82,7 +82,9 @@ export default class LandingSession extends Session {
   }
 
   async downloadAndPatch() {
-    const { cli, upstream, prid, expectedCommitShas, crossRepoPR } = this;
+    const {
+      cli, upstream, prid, expectedCommitShas, crossRepoPR, landedCommitSha
+    } = this;
 
     if (crossRepoPR) {
       const { owner, repo } = this;
@@ -107,33 +109,70 @@ export default class LandingSession extends Session {
             { ignoreFailure: false });
         }
       } while (!isHeadAMergeCommit());
+    } else if (landedCommitSha) {
+      // The PR already landed (e.g. a security fix released publicly), so
+      // its merge ref is gone - fetch the commits from the base branch.
+      cli.startSpinner(`Downloading landed commits for ${prid}`);
+      await forceRunAsync('git', ['fetch', upstream, landedCommitSha],
+        { ignoreFailure: false });
     } else {
       cli.startSpinner(`Downloading patch for ${prid}`);
       await runAsync('git', [
         'fetch', upstream,
         `refs/pull/${prid}/merge`]);
     }
 
-    // We fetched the commit that would result if we used `git merge`.
-    // ^1 and ^2 refer to the PR base and the PR head, respectively.
-    const [base, head, rebaseHead] = await runAsync('git',
-      ['rev-parse', 'FETCH_HEAD^1', 'FETCH_HEAD^2', 'HEAD'],
-      { captureStdout: 'lines' });
+    let base, head, rebaseHead;
+    if (landedCommitSha && !crossRepoPR) {
+      // FETCH_HEAD is the last commit of the PR as landed on the base branch.
+      // Walk back while the PR-URL trailer still points to this PR to find
+      // the base of the landed series (landing may have squashed commits).
+      const prUrlRe = new RegExp(`^PR-URL: \\S+/pull/${prid}$`, 'm');
+      let count = 0;
+      while (count < expectedCommitShas.length) {
+        const message = await runAsync('git',
+          ['log', '-1', '--format=%B', `FETCH_HEAD~${count}`],
+          { captureStdout: true });
+        if (!prUrlRe.test(message)) break;
+        count++;
+      }
+      if (count === 0) {
+        cli.error(`Landed commit ${landedCommitSha} does not have a ` +
+          `PR-URL trailer pointing to pull request ${prid}`);
+        process.exit(1);
+      }
+      [base, head, rebaseHead] = await runAsync('git',
+        ['rev-parse', `FETCH_HEAD~${count}`, 'FETCH_HEAD', 'HEAD'],
+        { captureStdout: 'lines' });
+    } else {
+      // We fetched the commit that would result if we used `git merge`.
+      // ^1 and ^2 refer to the PR base and the PR head, respectively.
+      [base, head, rebaseHead] = await runAsync('git',
+        ['rev-parse', 'FETCH_HEAD^1', 'FETCH_HEAD^2', 'HEAD'],
+        { captureStdout: 'lines' });
+    }
     const commitShas = await runAsync('git',
       ['rev-list', `${base}..${head}`],
       { captureStdout: 'lines' });
     cli.stopSpinner(`Fetched commits as ${shortSha(base)}..${shortSha(head)}`);
     cli.separator();
 
-    const mismatchedCommits = [
-      ...commitShas.filter((sha) => !expectedCommitShas.includes(sha))
-        .map((sha) => `Unexpected commit ${sha}`),
-      ...expectedCommitShas.filter((sha) => !commitShas.includes(sha))
-        .map((sha) => `Missing commit ${sha}`)
-    ].join('\n');
-    if (mismatchedCommits.length > 0) {
-      cli.error(`Mismatched commits:\n${mismatchedCommits}`);
-      process.exit(1);
+    if (landedCommitSha && !crossRepoPR) {
+      // The landed commits have different SHAs from the ones in the PR, so
+      // they cannot be compared - they were validated by their PR-URL
+      // trailers above.
+      cli.ok(`Using ${commitShas.length} commit(s) as landed for PR ${prid}`);
+    } else {
+      const mismatchedCommits = [
+        ...commitShas.filter((sha) => !expectedCommitShas.includes(sha))
+          .map((sha) => `Unexpected commit ${sha}`),
+        ...expectedCommitShas.filter((sha) => !commitShas.includes(sha))
+          .map((sha) => `Missing commit ${sha}`)
+      ].join('\n');
+      if (mismatchedCommits.length > 0) {
+        cli.error(`Mismatched commits:\n${mismatchedCommits}`);
+        process.exit(1);
+      }
     }
 
     const commitInfo = { base, head, shas: commitShas, rebaseHead };

lib/queries/PR.gql

@@ -31,7 +31,10 @@ query PR($prid: Int!, $owner: String!, $repo: String!) {
       closed,
       closedAt,
       merged,
-      mergedAt
+      mergedAt,
+      mergeCommit {
+        oid
+      }
     }
   }
 }