.github/workflows/issue-release-workflow.yml

# This contains the workflow definitions that allow users to test backports
# to the release branch using comments on issues.
#
# /cherry-pick <commit> <...>
#
# This comment will attempt to cherry-pick the given commits to the latest
# release branch (release/Y.x) and if successful, push the result to a branch
# on github.
#
# /branch <owner>/<repo>/<branch>
#
# This comment will create a pull request from <branch> to the latest release
# branch.

name: Issue Release Workflow

permissions:
  contents: read

on:
  issue_comment:
    types:
      - created
      - edited
  issues:
    types:
      - opened


jobs:
  backport-commits-validate-input:
    runs-on: ubuntu-26.04
    if: >-
      (github.repository == 'llvm/llvm-project') &&
      !startswith(github.event.comment.body, '<!--IGNORE-->') &&
      contains(github.event.action == 'opened' && github.event.issue.body || github.event.comment.body, '/cherry-pick')
    outputs:
      comment-body: ${{ steps.validate.outputs.comment-body }}
    steps:
      - name: Validate Input Comment
        id: validate
        env:
          COMMENT_BODY: ${{ github.event.action == 'opened' && github.event.issue.body || github.event.comment.body  }}
        run: |
          # This will strip out everything from the comment except for the /cherry-pick commands.
          # If there are multiple /cherry-pick commands they will all be included in the output.
          # This is fine since the github-automation.py script can handle multiple cherry-pick commands.
          validated_comment=$(\
            grep -o -e '/cherry-pick \(\(https://github.com/llvm/llvm-project/commit/\)\?[a-f0-9]\+ *\)\+' <<< $COMMENT_BODY \
          )
          echo "Validated Comment is:"
          echo ${validated_comment}

          echo comment-body=${validated_comment} >> $GITHUB_OUTPUT

  backport-commits:
    name: Backport Commits
    runs-on: ubuntu-26.04
    environment: main-branch-only
    needs:
      - backport-commits-validate-input
    permissions:
      issues: write
      pull-requests: write
    steps:
      - name: Fetch LLVM sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: llvm/llvm-project
          # GitHub stores the token used for checkout and uses it for pushes
          # too, but we want to use a different token for pushing, so we need
          # to disable persist-credentials here.
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Environment
        run: |
          pip install --require-hashes -r ./llvm/utils/git/requirements.txt
          ./llvm/utils/git/github-automation.py --token ${{ github.token }} setup-llvmbot-git

      - name: Backport Commits
        env:
          COMMENT_BODY: ${{ needs.backport-commits-validate-input.outputs.comment-body }}
          REQUESTED_BY: ${{ (github.event.action == 'opened' && github.event.issue.user.login) || github.event.comment.user.login }}
        run: |
          printf "%s" "$COMMENT_BODY" |
          ./llvm/utils/git/github-automation.py \
          --repo "$GITHUB_REPOSITORY" \
          --token "${{ secrets.RELEASE_WORKFLOW_PR_CREATE }}" \
          release-workflow \
          --branch-repo-token ${{ secrets.RELEASE_WORKFLOW_PUSH_SECRET }} \
          --issue-number ${{ github.event.issue.number }} \
          --requested-by "$REQUESTED_BY" \
          auto