Skip to content

Commit 906ca64

Browse files
petesramekpetesramek
authored
add backtrack workflow with branch locking to prevent race conditions (#185)
## Summary Adds `.github/workflows/backtrack.yml` — an automated workflow that back-merges changes from higher branches into lower branches after a PR is merged, with branch locking to prevent race conditions. ## Background Currently the back-merges (e.g. `Merge branch 'preview/1.0' into develop/1.0`) are done manually. Without any coordination, a developer could push a commit to `develop/M.n` between the moment the workflow reads the branch tip and when it pushes the merge — causing the push to fail or producing an incorrect merge base. ## What the workflow does **Trigger**: any PR that is _merged_ into `preview/**` or `release/**` | Source (base_ref) | Backtrack cascade | |---|---| | `preview/M.n` | `preview/M.n → develop/M.n` | | `release/M.n` | `release/M.n → preview/M.n → develop/M.n` | **Race-condition protection**: 1. `develop/M.n` is **locked** (branch protection applied) before any merge begins — blocking concurrent direct pushes from developers. 2. All pushes use `GH_ADMIN_TOKEN`, which bypasses `enforce_admins: false` protection — so the workflow can push even to a locked branch. 3. `develop/M.n` is **unlocked** in an `always()` step keyed on `steps.lock-develop.outcome != 'skipped'` — ensures cleanup even if a merge fails. 4. `preview/M.n` is already permanently locked by `promote-branch.yml` and does not need extra lock/unlock steps; the admin token bypasses it for the release→preview merge. ## Impact on other workflows - **`bump-version.yml`**: unaffected — it creates brand-new branches via `workflow_dispatch` (no PR merge event) and pushes to branches that have no protection yet. - **`promote-branch.yml`**: unaffected — it handles forward promotion and creates/locks branches on first creation. - **`release.yml`**: unaffected — it handles building, publishing, and creating support branches.
1 parent 314d35e commit 906ca64

1 file changed

Lines changed: 107 additions & 0 deletions

File tree

‎.github/workflows/backtrack.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: 'Backtrack'
2+
3+
on:
4+
pull_request:
5+
types:
6+
- closed
7+
branches:
8+
- 'preview/**'
9+
- 'release/**'
10+
11+
permissions:
12+
actions: read
13+
contents: write
14+
15+
concurrency:
16+
group: backtrack-${{ github.base_ref }}
17+
cancel-in-progress: false
18+
19+
jobs:
20+
backtrack:
21+
name: 'Backtrack changes from ${{ github.base_ref }}'
22+
if: ${{ github.event.pull_request.merged == true }}
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: 'Checkout ${{ github.base_ref }}'
26+
uses: actions/checkout@v6
27+
with:
28+
ref: ${{ github.base_ref }}
29+
fetch-depth: 0
30+
token: ${{ secrets.GH_ADMIN_TOKEN }}
31+
32+
- name: 'Configure git'
33+
run: |
34+
git config user.name "$(git log -n 1 --pretty=format:%an)"
35+
git config user.email "$(git log -n 1 --pretty=format:%ae)"
36+
37+
- name: 'Resolve backtrack targets'
38+
id: targets
39+
run: |
40+
base_ref="${{ github.base_ref }}"
41+
if [[ "$base_ref" == preview/* ]]; then
42+
version="${base_ref#preview/}"
43+
echo "preview-branch=" >> $GITHUB_OUTPUT # no intermediate branch; merge directly into develop
44+
echo "develop-branch=develop/$version" >> $GITHUB_OUTPUT
45+
echo "merge-source=$base_ref" >> $GITHUB_OUTPUT
46+
elif [[ "$base_ref" == release/* ]]; then
47+
version="${base_ref#release/}"
48+
echo "preview-branch=preview/$version" >> $GITHUB_OUTPUT
49+
echo "develop-branch=develop/$version" >> $GITHUB_OUTPUT
50+
echo "merge-source=preview/$version" >> $GITHUB_OUTPUT
51+
fi
52+
53+
- name: 'Check if develop branch exists'
54+
id: check-develop
55+
run: |
56+
git fetch origin
57+
if git ls-remote --exit-code --heads origin "${{ steps.targets.outputs.develop-branch }}" > /dev/null 2>&1; then
58+
echo "exists=true" >> $GITHUB_OUTPUT
59+
else
60+
echo "exists=false" >> $GITHUB_OUTPUT
61+
echo "::warning::Develop branch '${{ steps.targets.outputs.develop-branch }}' not found, skipping backtrack."
62+
fi
63+
64+
- name: 'Lock develop branch'
65+
id: lock-develop
66+
if: ${{ steps.check-develop.outputs.exists == 'true' }}
67+
uses: './.github/actions/github/branch-protection/lock'
68+
with:
69+
branch: ${{ steps.targets.outputs.develop-branch }}
70+
token: ${{ secrets.GH_ADMIN_TOKEN }}
71+
72+
- name: 'Backtrack: merge ${{ github.base_ref }} into ${{ steps.targets.outputs.preview-branch }}'
73+
if: ${{ steps.targets.outputs.preview-branch != '' }}
74+
run: |
75+
git fetch origin
76+
git checkout -B ${{ steps.targets.outputs.preview-branch }} origin/${{ steps.targets.outputs.preview-branch }}
77+
git merge --no-ff origin/${{ github.base_ref }} -m "Backtrack: merge ${{ github.base_ref }} into ${{ steps.targets.outputs.preview-branch }}"
78+
git push origin ${{ steps.targets.outputs.preview-branch }}
79+
80+
- name: 'Backtrack: merge ${{ steps.targets.outputs.merge-source }} into ${{ steps.targets.outputs.develop-branch }}'
81+
if: ${{ steps.check-develop.outputs.exists == 'true' }}
82+
run: |
83+
git fetch origin
84+
git checkout -B ${{ steps.targets.outputs.develop-branch }} origin/${{ steps.targets.outputs.develop-branch }}
85+
git merge --no-ff origin/${{ steps.targets.outputs.merge-source }} -m "Backtrack: merge ${{ steps.targets.outputs.merge-source }} into ${{ steps.targets.outputs.develop-branch }}"
86+
git push origin ${{ steps.targets.outputs.develop-branch }}
87+
88+
- name: 'Unlock develop branch'
89+
if: ${{ always() && steps.lock-develop.outcome != 'skipped' }}
90+
uses: './.github/actions/github/branch-protection/unlock'
91+
with:
92+
branch: ${{ steps.targets.outputs.develop-branch }}
93+
token: ${{ secrets.GH_ADMIN_TOKEN }}
94+
95+
- name: 'Write backtrack summary'
96+
if: ${{ always() }}
97+
run: |
98+
echo "## 🔁 Backtrack Summary" >> $GITHUB_STEP_SUMMARY
99+
echo "" >> $GITHUB_STEP_SUMMARY
100+
echo "| Branch | Merged from |" >> $GITHUB_STEP_SUMMARY
101+
echo "|--------|-------------|" >> $GITHUB_STEP_SUMMARY
102+
if [[ "${{ steps.targets.outputs.preview-branch }}" != "" ]]; then
103+
echo "| \`${{ steps.targets.outputs.preview-branch }}\` | \`${{ github.base_ref }}\` |" >> $GITHUB_STEP_SUMMARY
104+
fi
105+
if [[ "${{ steps.check-develop.outputs.exists }}" == "true" ]]; then
106+
echo "| \`${{ steps.targets.outputs.develop-branch }}\` | \`${{ steps.targets.outputs.merge-source }}\` |" >> $GITHUB_STEP_SUMMARY
107+
fi

0 commit comments

Comments
 (0)