search

dotnet / arcade

Tools that provide common build infrastructure for multiple .NET Foundation projects.
MIT License
671 stars 347 forks source link

Extract backport action from dotnet/runtime into arcade #7373

Closed akoeplinger closed 3 years ago

akoeplinger commented 3 years ago

In dotnet/runtime we're using a GitHub Action that allows you to comment /backport to <branch> on your PR and the action will open a new PR targetting the respective branch.

@wtgodbe asked me about having the same for aspnetcore and while we can just copy the GH Action files over I feel like this would be a better fit for some common arcade solution.

I can think of two approaches: 1) Extract the action code into a separate repository (this is how GH Actions are usually shared: https://docs.github.com/en/actions/learn-github-actions/finding-and-customizing-actions#using-release-management-for-your-custom-actions) 2) Flow the code into repos via arcade's eng/common

The implementation in dotnet/runtime lives in these two files/folders:

riarenas commented 3 years ago

Removed the First responder label so this gets triaged, and it also doesn't seem appropriate to be handled in FR.

Currently we are not supposed to be using GitHub Actions, so I don't think it'd be appropriate for Arcade to distribute it. Perhaps it's something that we could add to dotnet/versions?

@markwilkie @tkapin this is what @lukas-lansky brought up today during our sync.

markwilkie commented 3 years ago

Having this be part of eng/common is probably not (yet) warranted given the unsupported nature of gh actions and future changes. However, having the code live in the arcade repo (basically #1) probably seems fine I think.

@mmitche - thoughts on this? Mostly thinking about any security ramifications of using gh actions to backport.

mmitche commented 3 years ago

I'm fine by it. There have been some Action related security issues in the past. However, IIRC when I looked at them before, none would apply in that case. However, we should re-evaluate it before pulling it into arcade. See https://securitylab.github.com/research/github-actions-untrusted-input/

akoeplinger commented 3 years ago

However, having the code live in the arcade repo (basically #1) probably seems fine I think.

Note that we can't put it in dotnet/arcade if we go that route but it needs to be a separate, standalone repo since GH Actions expects an action.yml in the root of the repo.

markwilkie commented 3 years ago

it needs to be a separate, standalone repo since GH Actions expects an action.yml in the root of the repo.

Oh, I see yea.

markwilkie commented 3 years ago

What are the next steps here @akoeplinger ?

MattGal commented 3 years ago

[Async Triage] : I lack context but am commenting as those are the rules. Seems like a good thing to extract from runtime and not FR, to echo previous comments.

jakubstilec commented 3 years ago

[Async Triage]: Created teams chat

MattGal commented 3 years ago

[Async Triage]: commented in chat.

markwilkie commented 3 years ago

Thoughts on next steps @akoeplinger ? This issue is languishing a bit...

markwilkie commented 3 years ago

closing due to diminished interest.