App/.github/workflows/cherryPick.yml at main · Expensify/App

463 lines (412 loc) · 21.7 KB
name: Cherry-pick a pull request
  workflow_dispatch:
    inputs:
      PULL_REQUEST_URL:
        description: The full URL of the E/App or E/Mobile-Expensify pull request to cherry-pick
        required: true
      TARGET:
        description: CP to staging or production?
        required: true
        type: choice
        options:
          - staging
          - production
        default: staging
  workflow_call:
    inputs:
      # Note: this is required for manually-run CP's, but we don't require it for the workflow_call trigger.
      # The reason is that this workflow is only called programmatically after a CP to Prod,
      # and in that case we just want to CP a version bump - no other PR.
      PULL_REQUEST_URL:
        description: The full URL of the E/App or E/Mobile-Expensify pull request to cherry-pick
        type: string
        required: false
      TARGET:
        description: CP to staging or production?
        type: string
        required: true
concurrency:
  group: "cherrypick"
  cancel-in-progress: false
  validate:
    runs-on: blacksmith-2vcpu-ubuntu-2404
      - name: Validate pull request URL
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        run: |
          REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')
          if [[ "$REPO_FULL_NAME" != ${{ github.repository }} ]] && [[ ! "$REPO_FULL_NAME" =~ Expensify/Mobile-Expensify* ]]; then
            echo "::error::❌ Cherry picks are only supported for the Expensify/App and Expensify/Mobile-Expensify repositories. Found: $REPO_FULL_NAME"
            exit 1
      - name: Verify PR is merged
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
        run: |
          if gh pr view "${{ inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt'; then
            echo "PR is merged: ${{ inputs.PULL_REQUEST_URL }}"
          else
            echo "::error::❌ PR is not merged: ${{ inputs.PULL_REQUEST_URL }}"
            exit 1
  createNewVersion:
    uses: ./.github/workflows/createNewVersion.yml
    secrets: inherit
    needs: [validate]
      # In order to submit a new build for production review, it must have a higher PATCH version than the previously-submitted build.
      # The typical case is that with each staging deploy, we bump the BUILD version, and with each prod deploy we bump the PATCH version.
      # However, if PULL_REQUEST_URL is empty, we assume we want to do a PATCH version bump.
      # The reason we assume that is because the use-case for a no-PR CP is after a CP to Production.
      # In that case, we need to bump the staging version to be higher than prod.
      # We use a patch version so that there's a diff in both `CFBundleVersion` and `CFBundleShortVersion` on iOS,
      # so that when we later CP that version bump to staging, the `CFBundleShortVersion` diff is picked up as well.
      SEMVER_LEVEL: ${{ (inputs.TARGET == 'production' || inputs.PULL_REQUEST_URL == '') && 'PATCH' || 'BUILD' }}
  cherryPick:
    needs: createNewVersion
    runs-on: blacksmith-2vcpu-ubuntu-2404
      - name: Extract PR information
        # Note: this step is only skipped when there's no PULL_REQUEST_URL, which is only ever be the case when we're CPing just a version bump.
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: getPRInfo
        run: |
          echo "REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')" >> "$GITHUB_OUTPUT"
          echo "PR_NUMBER=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|.*/pull/([0-9]+).*|\1|')" >> "$GITHUB_OUTPUT"
      - name: Set conflict branch name
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: getBranchName
        run: echo "CONFLICT_BRANCH_NAME=cherry-pick-${{ inputs.TARGET }}-${{ steps.getPRInfo.outputs.PR_NUMBER }}-${{ github.run_id }}-${{ github.run_attempt }}" >> "$GITHUB_OUTPUT"
      - name: Checkout target branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ inputs.TARGET }}
          token: ${{ secrets.OS_BOTIFY_TOKEN }}
          submodules: true
      # This command is necessary to fetch any branch other than main in the submodule.
      # See https://github.com/actions/checkout/issues/1815#issuecomment-2777836442 for further context.
      - name: Enable branch-switching in submodules
        run: |
          git submodule foreach '\
            git config --add remote.origin.fetch "+refs/heads/staging:refs/remotes/origin/staging" && \
            git config --add remote.origin.fetch "+refs/heads/production:refs/remotes/origin/production"'
      - name: Set up git for OSBotify
        id: setupGitForOSBotify
        uses: Expensify/GitHub-Actions/setupGitForOSBotify@main
        with:
          OP_VAULT: ${{ vars.OP_VAULT }}
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          OS_BOTIFY_APP_ID: ${{ secrets.OS_BOTIFY_APP_ID }}
          OS_BOTIFY_PRIVATE_KEY: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }}
      - name: Get previous app version
        id: getPreviousVersion
        uses: ./.github/actions/javascript/getPreviousVersion
        with:
          SEMVER_LEVEL: ${{ inputs.TARGET == 'staging' && 'PATCH' || 'MINOR' }}
      - name: Fetch history of relevant refs
        run: |
          git fetch origin main ${{ inputs.TARGET }} --no-recurse-submodules --no-tags --shallow-exclude ${{ steps.getPreviousVersion.outputs.PREVIOUS_VERSION }}
          cd Mobile-Expensify
          git fetch origin main ${{ inputs.TARGET }} --no-recurse-submodules --no-tags --shallow-exclude ${{ steps.getPreviousVersion.outputs.PREVIOUS_VERSION }}
      - name: Get E/App version bump commit
        id: getVersionBumpCommit
        run: |
          git switch main
          VERSION_BUMP_COMMIT="$(git log -1 --format='%H' --author='OSBotify' --grep 'Update version to ${{ needs.createNewVersion.outputs.NEW_VERSION }}')"
          if [ -z "$VERSION_BUMP_COMMIT" ]; then
            echo "::error::❌ Could not find E/App version bump commit for ${{ needs.createNewVersion.outputs.NEW_VERSION }}"
            echo "::error::This may indicate E/App and Mobile-Expensify versions are out of sync"
            echo "::error::Run the syncVersions workflow to fix, then retry this cherry-pick"
            git log --oneline -20
            exit 1
          echo "::notice::👀 Found E/App version bump commit $VERSION_BUMP_COMMIT"
          echo "VERSION_BUMP_SHA=$VERSION_BUMP_COMMIT" >> "$GITHUB_OUTPUT"
      - name: Get Mobile-Expensify version bump commit
        id: getMobileExpensifyVersionBumpCommit
        working-directory: Mobile-Expensify
        run: |
          git switch main
          VERSION_BUMP_COMMIT="$(git log -1 --format='%H' --author='OSBotify' --grep 'Update version to ${{ needs.createNewVersion.outputs.NEW_VERSION }}')"
          if [ -z "$VERSION_BUMP_COMMIT" ]; then
            echo "::error::❌ Could not find Mobile-Expensify version bump commit for ${{ needs.createNewVersion.outputs.NEW_VERSION }}"
            echo "::error::This may indicate E/App and Mobile-Expensify versions are out of sync"
            echo "::error::Run the syncVersions workflow to fix, then retry this cherry-pick"
            git log --oneline -20
            exit 1
          echo "::notice::👀 Found Mobile-Expensify version bump commit $VERSION_BUMP_COMMIT"
          echo "VERSION_BUMP_SHA=$VERSION_BUMP_COMMIT" >> "$GITHUB_OUTPUT"
      - name: Get merge commit for pull request to CP
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: getCPMergeCommit
        run: |
          read -r MERGE_COMMIT_SHA MERGE_ACTOR PR_AUTHOR <<< "$(gh pr view ${{ inputs.PULL_REQUEST_URL }} --json mergeCommit,mergedBy,author --jq '"\(.mergeCommit.oid) \(.mergedBy.login) \(.author.login)"')"
            echo "MERGE_COMMIT_SHA=$MERGE_COMMIT_SHA"
            echo "MERGE_ACTOR=$MERGE_ACTOR"
            echo "PR_AUTHOR=$PR_AUTHOR"
          } >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
      - name: Cherry-pick the Mobile-Expensify version bump to Mobile-Expensify target branch
        working-directory: Mobile-Expensify
        run: |
          git switch ${{ inputs.TARGET }}
          git cherry-pick -S -x --mainline 1 --strategy=recursive -Xtheirs ${{ steps.getMobileExpensifyVersionBumpCommit.outputs.VERSION_BUMP_SHA }}
          git commit --amend -m "$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"
          git push origin ${{ inputs.TARGET }}
      - name: Cherry-pick the E/App version-bump to target branch
        run: |
          git switch ${{ inputs.TARGET }}
          git cherry-pick -S -x --mainline 1 --strategy=recursive -Xtheirs ${{ steps.getVersionBumpCommit.outputs.VERSION_BUMP_SHA }}
          git commit --amend -m "$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"
      - name: Update the Mobile-Expensify submodule on E/App target branch
        run: |
          git add Mobile-Expensify
          git commit -m "Update Mobile-Expensify submodule version to ${{ needs.createNewVersion.outputs.NEW_VERSION }}"
      - name: Cherry-pick the merge commit of target PR
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        id: cherryPick
        # If cherry picking a Mobile-Expensify change, we need to run the cherry pick in the Mobile-Expensify directory
        working-directory: ${{ startsWith(steps.getPRInfo.outputs.REPO_FULL_NAME, 'Expensify/Mobile-Expensify') && 'Mobile-Expensify' || '.' }}
        run: |
          echo "Attempting to cherry-pick ${{ steps.getCPMergeCommit.outputs.MERGE_COMMIT_SHA }}"
          if git cherry-pick -S -x --mainline 1 ${{ steps.getCPMergeCommit.outputs.MERGE_COMMIT_SHA }}; then
            echo "🎉 No conflicts! CP was a success, PR can be automerged 🎉"
            echo "HAS_CONFLICTS=false" >> "$GITHUB_OUTPUT"
            git commit --amend -m "$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"
          else
            echo "😞 PR can't be automerged, there are merge conflicts in the following files:"
            git --no-pager diff --name-only --diff-filter=U
            git cherry-pick --abort
            echo "HAS_CONFLICTS=true" >> "$GITHUB_OUTPUT"
      - name: Push changes
        run: |
          if [[ '${{ steps.cherryPick.outputs.HAS_CONFLICTS }}' == 'true' ]]; then
            git checkout -b ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}
            git push --set-upstream origin ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}
          else
            if [[ "${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}" =~ Expensify/Mobile-Expensify* ]]; then
              # Push Mobile-Expensify changes first
              cd Mobile-Expensify
              git push origin ${{ inputs.TARGET }}
              cd ..
              # Update and commit the submodule reference in E/App
              git add Mobile-Expensify
              git commit -m "Update Mobile-Expensify submodule to include cherry-picked PR #${{ steps.getPRInfo.outputs.PR_NUMBER }}"
            # Push E/App changes
            git push origin ${{ inputs.TARGET }}
      - name: Find deploy workflow run
        # Also runs for version-bump-only CPs where HAS_CONFLICTS is unset
        if: ${{ steps.cherryPick.outputs.HAS_CONFLICTS != 'true' }}
        id: findDeployRun
        run: |
          PUSH_SHA=$(git rev-parse HEAD)
          echo "Push SHA: $PUSH_SHA"
          DEPLOY_RUN_URL=""
          for i in 1 2 3 4 5 6; do
            echo "Polling for deploy run (attempt $i)..."
            sleep 10
            DEPLOY_RUN_URL=$(gh api \
              "repos/${{ github.repository }}/actions/workflows/deploy.yml/runs?head_sha=$PUSH_SHA&per_page=1" \
              --jq '.workflow_runs[0].html_url // empty' 2>/dev/null || true)
            if [ -n "$DEPLOY_RUN_URL" ]; then
              echo "Found deploy run: $DEPLOY_RUN_URL"
              break
          done
          FALLBACK_URL="https://github.com/${{ github.repository }}/actions/workflows/deploy.yml"
          if [ -z "$DEPLOY_RUN_URL" ]; then
            echo "::warning::Could not find deploy workflow run for SHA $PUSH_SHA"
              echo "DEPLOY_RUN_FOUND=false"
              echo "DEPLOY_RUN_URL=$FALLBACK_URL"
              echo "DEPLOY_RUN_MESSAGE=⚠️ Could not locate deploy run — check $FALLBACK_URL"
            } >> "$GITHUB_OUTPUT"
          else
              echo "DEPLOY_RUN_FOUND=true"
              echo "DEPLOY_RUN_URL=$DEPLOY_RUN_URL"
              echo "DEPLOY_RUN_MESSAGE=$DEPLOY_RUN_URL"
            } >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ github.token }}
      - name: Announce successful CP in #deployer
        # Also runs for version-bump-only CPs where HAS_CONFLICTS is unset
        if: ${{ steps.cherryPick.outputs.HAS_CONFLICTS != 'true' }}
        uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e
        with:
          status: custom
          custom_payload: |
              channel: '#deployer',
              attachments: [{
                color: 'good',
                text: `🍒 Cherry-pick to *${{ inputs.TARGET }}* successfully started\nPR: ${{ inputs.PULL_REQUEST_URL || '(version bump only)' }}\nDeploy workflow: ${{ steps.findDeployRun.outputs.DEPLOY_RUN_MESSAGE }}`
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
      - name: Write workflow summary
        # Also runs for version-bump-only CPs where HAS_CONFLICTS is unset
        if: ${{ steps.cherryPick.outputs.HAS_CONFLICTS != 'true' }}
        run: |
            echo "## Cherry-pick successful"
            echo ""
            echo "**Target:** \`${{ inputs.TARGET }}\`"
            echo "**PR:** ${{ inputs.PULL_REQUEST_URL || 'N/A (version bump only)' }}"
            if [[ "${{ steps.findDeployRun.outputs.DEPLOY_RUN_FOUND }}" == "true" ]]; then
              echo "**Deploy workflow:** ${{ steps.findDeployRun.outputs.DEPLOY_RUN_URL }}"
            else
              echo "**Deploy workflow:** :warning: Could not locate deploy run — check [${{ inputs.TARGET }} deploy runs](${{ steps.findDeployRun.outputs.DEPLOY_RUN_URL }})"
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Create Pull Request to manually finish CP
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        id: createPullRequest
        run: |
          AUTHOR_CHECKLIST=$(sed -n '/### PR Author Checklist/,$p' .github/PULL_REQUEST_TEMPLATE.md)
          PR_DESCRIPTION=$(cat <<EOF
          🍒 Cherry pick ${{ inputs.PULL_REQUEST_URL }} to ${{ inputs.TARGET }} 🍒
          This PR had conflicts when we tried to cherry-pick it to ${{ inputs.TARGET }}. You'll need to manually perform the cherry-pick, using the following steps:
          \`\`\`bash
          git fetch
          git checkout ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}
          git cherry-pick -S -x --mainline 1 ${{ steps.getCPMergeCommit.outputs.MERGE_COMMIT_SHA }}
          \`\`\`
          Then manually resolve conflicts, and commit the change with \`git cherry-pick --continue\`. Lastly, please run:
          \`\`\`bash
          git commit --amend -m "\$(git log -1 --pretty=%B)" -m "(cherry-picked to ${{ inputs.TARGET }} by ${{ github.actor }})"
          \`\`\`
          This last part is important. It will help us keep track of who triggered this CP, and will ensure that version bumps are tracked correctly. Once all that's done, push your changes with \`git push origin ${{ steps.getBranchName.outputs.CONFLICT_BRANCH_NAME }}\`, and then open this PR for review.
          Note that you **must** test this PR, and both the author and reviewer checklist should be completed, just as if you were merging the PR to main.
          _Pro-tip:_ If this PR appears to have conflicts against the _${{ inputs.TARGET }}_ base, it means that the version on ${{ inputs.TARGET }} has been updated. The easiest thing to do if you see this is to close the PR and re-run the CP.
          $AUTHOR_CHECKLIST
          EOF
          # Create PR
          gh pr create \
            --title "🍒 Cherry pick PR #${{ steps.getPRInfo.outputs.PR_NUMBER }} to ${{ inputs.TARGET }} 🍒" \
            --body "$PR_DESCRIPTION" \
            --label "Engineering,Hourly,${{ inputs.TARGET == 'staging' && 'CP Staging' || 'CP Production' }}" \
            --base "${{ inputs.TARGET }}"
          sleep 5
          # Save the Cherry-pick PR URL for Slack notification
          PR_URL="$(gh pr view --json url --jq .url)"
          echo "PR_URL=$PR_URL" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
      - name: Resolve Slack mentions for merge actor and CP initiator
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        id: resolveSlack
        run: |
          # Match Slack IDs to Github IDs using the whitelist
          WHITELIST=$(gh api repos/Expensify/Salt/contents/www/files/www-whitelist.php \
            --jq '.content' | base64 -d 2>/dev/null || true)
          resolve_slack_id() {
            local github_user="$1"
            if [ -n "$WHITELIST" ] && [ -n "$github_user" ]; then
              echo "$WHITELIST" \
                | grep -F -A 10 "'github' => '$github_user'" \
                | grep -oP -m 1 "'slack'\s*=>\s*'\K[^']+" || true
          PR_AUTHOR="${{ steps.getCPMergeCommit.outputs.PR_AUTHOR }}"
          MERGER="${{ steps.getCPMergeCommit.outputs.MERGE_ACTOR }}"
          CP_INITIATOR="${{ github.actor }}"
          PR_AUTHOR_SLACK=$(resolve_slack_id "$PR_AUTHOR")
          MERGER_SLACK=$(resolve_slack_id "$MERGER")
          CP_SLACK=$(resolve_slack_id "$CP_INITIATOR")
          # Collect unique, successfully resolved Slack IDs; fall back to @appdeployers if none resolve
          MENTIONS=""
          SEEN=""
          for sid in $PR_AUTHOR_SLACK $MERGER_SLACK $CP_SLACK; do
            pattern=" $sid "
            if [ -n "$sid" ] && [[ ! " $SEEN " =~ $pattern ]]; then
              MENTIONS="${MENTIONS:+$MENTIONS / }<@$sid>"
              SEEN="$SEEN $sid"
          done
          if [ -z "$MENTIONS" ]; then
            echo "SLACK_MENTION=<!subteam^S4TJJ3PSL>" >> "$GITHUB_OUTPUT"
          else
            echo "SLACK_MENTION=$MENTIONS" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
      - name: Announce CP conflict in #deployer
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e
        with:
          status: custom
          custom_payload: |
              channel: '#deployer',
              attachments: [{
                color: "#DB4545",
                pretext: `${{ steps.resolveSlack.outputs.SLACK_MENTION }}`,
                text: "🚨 Cherry-pick to ${{ inputs.TARGET }} has conflicts and requires manual resolution.\nOriginal PR: ${{ inputs.PULL_REQUEST_URL }}\nConflict PR: ${{ steps.createPullRequest.outputs.PR_URL }}"
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
      - name: Add assignees to conflict PRs
        if: steps.cherryPick.outputs.HAS_CONFLICTS == 'true'
        run: |
          gh pr edit --add-assignee "${{ github.actor }},${{ steps.getCPMergeCommit.outputs.MERGE_ACTOR }},${{ steps.getCPMergeCommit.outputs.PR_AUTHOR }}"
        env:
          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
        # In cases when the original PR author is outside the org, the `gh pr edit` command will fail. But we don't want to fail the workflow in that case.
        continue-on-error: true
      - name: Label original PR with CP label
        if: ${{ inputs.PULL_REQUEST_URL != '' }}
        run: gh pr edit ${{ inputs.PULL_REQUEST_URL }} --add-label '${{ inputs.TARGET == 'staging' && 'CP Staging' || 'CP Production' }}'
        env:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
      - name: "Announces a CP failure in the #announce Slack room"
        uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e
        if: ${{ failure() }}
        with:
          status: custom
          custom_payload: |
              channel: '#announce',
              attachments: [{
                color: "#DB4545",
                pretext: `<!subteam^S4TJJ3PSL>`,
                text: `💥 Failed to CP ${{ inputs.PULL_REQUEST_URL }} to ${{ inputs.TARGET }} 💥`,
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
      - name: "Announce CP cancellation in #deployer"
        uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e
        if: ${{ cancelled() }}
        with:
          status: custom
          custom_payload: |
              channel: '#deployer',
              attachments: [{
                color: 'warning',
                text: `🍒 Cherry-pick to *${{ inputs.TARGET }}* was cancelled\nPR: ${{ inputs.PULL_REQUEST_URL || '(version bump only)' }}\nWorkflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}`
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

cherryPick.yml

Latest commit

History

cherryPick.yml

File metadata and controls
