Integrate bot for cherry-picking / backporting commits to release branches #1767

karthikvetrivel · 2025-10-08T17:48:23Z

Usage

Add a /cherry-pick comment to your PR specifying target release branches:

/cherry-pick release-25.3
/cherry-pick release-24.9

When to add the comment:

Before merge: Bot acknowledges and automatically backports after PR is merged
After merge: Bot immediately starts backporting

What Happens

✅ Bot creates a new PR for each target branch
🏷️ Applies labels: backport + auto-backport (clean) or needs-manual-resolution (conflicts)
💬 Posts a comment with link to each backport PR

Example

Example of a PR where you specify the target release branch:

Example of new PR opened:

Conflict Handling

If cherry-pick has conflicts:

PR is created in draft mode with needs-manual-resolution label
Follow instructions in the backport PR description to resolve conflicts

Branch Naming

Release branches must follow the pattern: release-X.Y

Examples: release-25.3, release-24.9.1, release-23.9

Example

Original PR #1234 merged to main
  ↓
/cherry-pick release-25.3 comment
  ↓
Bot creates PR #1235: [release-25.3] Original PR title

…nches Signed-off-by: Karthik Vetrivel <[email protected]>

cdesiniotis

Made a quick first pass. This is a great start!

cdesiniotis · 2025-10-08T17:59:03Z

.github/workflows/main.yml

+            let branches = [];
+
+            // Get PR number
+            const prNumber = context.payload.pull_request?.number || context.payload.issue?.number;


Question -- is grabbing a github issue number (the RHS of the conditional statement) necessary / correct here?

Yes, I believe so. I found that when the workflow is triggered by someone commenting / cherry-pick on a PR, GitHub's API doesn't populate context.payload.pull_request. Instead, the PR information is in context.payload.issue. The fallback ensures we get the PR number in both trigger scenarios.

cdesiniotis · 2025-10-08T18:00:41Z

.github/workflows/main.yml

+              const bodyMatches = prBody.matchAll(/\/cherry-pick\s+(release-[\d.]+)/g);
+              branches.push(...Array.from(bodyMatches, m => m[1]));


I am not quite following this. Could you explain what this is doing and why searching the PR body is required? From a quick glance I would assume that searching through the PR comments, as is done below, would suffice.

I added this in the case that the PR author knows upfront which branches need the backport and wants to declare it in the PR description, rather than needing to add a separate comment later. If you don't believe that this is a useful case, I can remove it--let me know

cdesiniotis · 2025-10-08T18:05:36Z

.github/workflows/main.yml

+
+      - name: Configure git
+        run: |
+          git config user.name "nvidia-bot"


nit: what about a more descriptive git username? nv-cherrypick-bot?

Agreed, will update.

EDIT: updated

cdesiniotis · 2025-10-08T18:08:30Z

.github/workflows/main.yml

+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  comment_id: context.payload.comment.id,
+                  content: 'eyes'


Yes! I was following the convention of some other fun workflow bots and add the eyes reaction to the comment

cdesiniotis · 2025-10-08T18:12:47Z

.github/workflows/main.yml

+                execSync(`git checkout -b ${backportBranch} ${targetBranch}`, { stdio: 'inherit' });
+
+                // Cherry-pick the merge commit
+                core.info(`Cherry-picking commit ${mergeCommitSha}`);


@tariq1890 this will cherry-pick the merge commits as opposed to the individual commits that are part of the PR. This differs from our current process of backporting individual commits (not merge commits). Do you have any objections to backporting the merge commits instead?

I strongly prefer the backport of the individual commits over merge commits. It is way more UI friendly when comparing git branches

Can't we retrieve the commits from a PR ID?

I can look into this, it should be possible.

Thanks @karthikvetrivel !

Done. Updated the PR message too now to reflect showing each individual commit.

Signed-off-by: Karthik Vetrivel <[email protected]>

ArangoGutierrez

Awesome initiative! left some comments

ArangoGutierrez · 2025-10-08T19:20:14Z

.github/workflows/main.yml

Let's rename the file to a more proper name, like cherrypick.yml or something

ArangoGutierrez · 2025-10-08T19:22:56Z

.github/workflows/main.yml

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Backport merged pull request


Cherry-Pick, all our workflow files follow a short name approach

ArangoGutierrez · 2025-10-08T19:23:45Z

.github/workflows/main.yml

+    # Run on merged PRs OR on /cherry-pick comments
+    if: |
+      (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true) ||
+      (github.event_name == 'issue_comment' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/cherry-pick'))


Does this mean that the cherry-pick will happen before the PR is approved and merged?

No. The PR must be merged before doing any cherry-picks (lines 118-144). If someone comments /cherry-pick on an unmerged PR, the bot just acknowledges it with 👀 and says it will backport after merge. The actual cherry-pick only happens once the PR is merged.

Generally, It's a convenience add—you can say "this needs to go to release-X.Y" while reviewing, and it'll happen when the PR merges.

tariq1890 · 2025-10-08T19:42:10Z

.github/workflows/main.yml

+          BRANCHES_JSON: ${{ steps.extract-branches.outputs.result }}
+        with:
+          script: |
+            const branches = JSON.parse(process.env.BRANCHES_JSON);


This JS script has a lot of lines. It's better to move them to a file instead of keeping them inline in the yaml file

Addressed, moved to seperated Javascript files.

Signed-off-by: Karthik Vetrivel <[email protected]>

karthikvetrivel · 2025-10-08T20:55:22Z

@tariq1890 Updated the backport bot to cherry-pick individual commits instead of merge commits. Tested with a 2-commit PR to verify it handles multiple commits correctly.

ArangoGutierrez · 2025-10-09T07:40:08Z

.github/scripts/backport.js

@@ -0,0 +1,222 @@
+module.exports = async ({ github, context, core }) => {


Can we have a Licence Header

ArangoGutierrez · 2025-10-09T07:40:53Z

.github/scripts/backport.js

+
+

Double end of file line

ArangoGutierrez · 2025-10-09T07:41:02Z

.github/scripts/extract-branches.js

@@ -0,0 +1,42 @@
+module.exports = async ({ github, context, core }) => {


Licence header

ArangoGutierrez · 2025-10-09T07:41:26Z

.github/workflows/cherrypick.yml

+
+

Double end of file line

ArangoGutierrez

Not a JS expert, just a few comments from what I can remember from my early days with JS

ArangoGutierrez · 2025-10-09T08:01:27Z

.github/workflows/cherrypick.yml

+
+      - name: Backport to release branches
+        id: backport
+        uses: actions/github-script@v7


Suggested change

uses: actions/github-script@v7

uses: actions/github-script@v8

ArangoGutierrez · 2025-10-09T08:04:12Z

.github/scripts/backport.js

+    // Create backport branch from target release branch
+    core.info(`Creating branch ${backportBranch} from ${targetBranch}`);
+    execSync(`git fetch origin ${targetBranch}:${targetBranch}`, { stdio: 'inherit' });
+    execSync(`git checkout -b ${backportBranch} ${targetBranch}`, { stdio: 'inherit' });


Suggested change

execSync(`git checkout -b ${backportBranch} ${targetBranch}`, { stdio: 'inherit' });

execSync(`git checkout ${backportBranch} || git checkout -b ${backportBranch} ${targetBranch}`, { stdio: 'inherit' });```

ArangoGutierrez · 2025-10-09T08:04:19Z

.github/scripts/extract-branches.js

+  if (context.payload.pull_request?.body) {
+    const prBody = context.payload.pull_request.body;
+    // Enforce release-X.Y or release-X.Y.Z
+    const bodyMatches = prBody.matchAll(/\/cherry-pick\s+(release-\d+\.\d+(?:\.\d+)?)/g);


Suggested change

const bodyMatches = prBody.matchAll(/\/cherry-pick\s+(release-\d+\.\d+(?:\.\d+)?)/g);

// Strict ASCII, anchored; allow X.Y or X.Y.Z

const bodyMatches = prBody.matchAll(/^\/cherry-pick\s+(release-\d+\.\d+(?:\.\d+)?)/gmi);

elezar · 2025-10-09T08:30:40Z

.github/scripts/backport.js

+1. Review the conflicts in the "Files changed" tab
+2. Check out this branch locally: \`git fetch origin ${backportBranch} && git checkout ${backportBranch}\`
+3. Resolve conflicts manually
+4. Push the resolution: \`git push origin ${backportBranch}\`


nit: Resolving the conflicts will most likely require a force push:

Suggested change

4. Push the resolution: \`git push origin ${backportBranch}\`

4. Push the resolution: \`git push -f origin ${backportBranch}\`

elezar · 2025-10-09T08:31:47Z

.github/scripts/backport.js

+git push origin ${backportBranch}
+\`\`\`
+</details>`
+      : `🤖 **Automated backport of #${prNumber} to \`${targetBranch}\`**


nit: I understand that this may be idiomatic, but looking for this : to differentiate between the two contents is not ideal.

elezar

Thanks @karthikvetrivel. This is great.

Is this something that we want to publish as an action at some point, or what options do we have to share this to other repos we own?

Maybe as a follow up: What does the landscape of available actions for doing this look like?

ArangoGutierrez · 2025-10-09T08:36:57Z

Thanks @karthikvetrivel. This is great.

Is this something that we want to publish as an action at some point, or what options do we have to share this to other repos we own?

++ To this, since @karthikvetrivel implementation is already in JS, we could have this JS code at k8s-test-infra and from there export it as a GitHub Action so we can reuse in all our repos

karthikvetrivel · 2025-10-09T14:35:10Z

@ArangoGutierrez @elezar thanks for the review! Regarding rollout, I see a few options.

As @ArangoGutierrez mentioned, we can host as reusable workflow in k8s-test-infra. Other repos can call it with something like this:

jobs: 
  cherrypick:
    uses: NVIDIA/k8s-test-infra/.github/workflows/cherrypick.yml@main

These seems the simplest to me.

Package as a composite action in k8s-test-infra. Repos would use it as a step:

  - uses: NVIDIA/k8s-test-infra/.github/actions/backport@main
    with:
      github-token: ${{ secrets.GITHUB_TOKEN }}

This gives repos more flexibility to add custom steps before/after, but our bot needs full job isolation for git operations (script will fail if initial starting state is incorrect), so option 1 seems better.

Build as a full JavaScript action with @vercel/ncc and publish to GitHub Marketplace. This would only makes sense if we want to open-source it for the broader community as it adds to build/release complexity.
Keep copy-paste approach (current state). Works but means updating multiple repos when we improve the logic.

It seems like option 1 is the best to me but would to leave hear your thoughts.

rajathagasthya · 2025-10-09T15:54:22Z

.github/scripts/backport.js

+1. Review the conflicts in the "Files changed" tab
+2. Check out this branch locally: \`git fetch origin ${backportBranch} && git checkout ${backportBranch}\`
+3. Resolve conflicts manually
+4. Push the resolution: \`git push -f origin ${backportBranch}\`


nit: just to be ultra-safe, I would recommend --force-with-lease instead of a plain -f.

Great point, resolved.

rajathagasthya · 2025-10-09T15:54:30Z

.github/scripts/backport.js

+# Resolve conflicts in your editor
+git add .
+git commit
+git push -f origin ${backportBranch}


Updated as well.

Signed-off-by: Karthik Vetrivel <[email protected]>

ArangoGutierrez · 2025-10-10T09:35:37Z

@ArangoGutierrez @elezar thanks for the review! Regarding rollout, I see a few options.

As @ArangoGutierrez mentioned, we can host as reusable workflow in k8s-test-infra. Other repos can call it with something like this:
jobs: 
  cherrypick:
    uses: NVIDIA/k8s-test-infra/.github/workflows/cherrypick.yml@main
These seems the simplest to me.

Package as a composite action in k8s-test-infra. Repos would use it as a step:
  - uses: NVIDIA/k8s-test-infra/.github/actions/backport@main
    with:
      github-token: ${{ secrets.GITHUB_TOKEN }}
This gives repos more flexibility to add custom steps before/after, but our bot needs full job isolation for git operations (script will fail if initial starting state is incorrect), so option 1 seems better.

Build as a full JavaScript action with @vercel/ncc and publish to GitHub Marketplace. This would only makes sense if we want to open-source it for the broader community as it adds to build/release complexity.

Keep copy-paste approach (current state). Works but means updating multiple repos when we improve the logic.

It seems like option 1 is the best to me but would to leave hear your thoughts.

As you recommend option 1, lets go with that.

I think we can finish the review here and once we all agree with the implementation, we can talk about a centralized GitHub action so other repos can benefit from this tool

karthikvetrivel · 2025-10-10T13:49:23Z

@ArangoGutierrez Thanks!

@elezar @cdesiniotis @tariq1890 what do you think about the current plan? As next steps, we can:

Close this PR w/o merging once everyone is satisfied with the outlined functionality
Centralize backport workflow as a reusable component in k8s-test-infra & discuss target repos we'd like to have the action
Create PRs in target repos for initiating the action.

Integrate bot for cherry-picking / backporting commits to release bra…

cb1895e

…nches Signed-off-by: Karthik Vetrivel <[email protected]>

karthikvetrivel requested review from ArangoGutierrez, cdesiniotis, elezar, shivamerla and tariq1890 as code owners October 8, 2025 17:48

cdesiniotis reviewed Oct 8, 2025

View reviewed changes

Address review comment: rename bot git username

855aee7

Signed-off-by: Karthik Vetrivel <[email protected]>

ArangoGutierrez assigned karthikvetrivel Oct 8, 2025

ArangoGutierrez reviewed Oct 8, 2025

View reviewed changes

tariq1890 reviewed Oct 8, 2025

View reviewed changes

ci: refactor cherry-pick workflow to backport individual commits

e1ae960

Signed-off-by: Karthik Vetrivel <[email protected]>

karthikvetrivel force-pushed the ci/integrate-cherry-pick-bot branch from 32320fc to e1ae960 Compare October 8, 2025 20:45

ArangoGutierrez reviewed Oct 9, 2025

View reviewed changes

ArangoGutierrez requested changes Oct 9, 2025

View reviewed changes

elezar reviewed Oct 9, 2025

View reviewed changes

rajathagasthya reviewed Oct 9, 2025

View reviewed changes

Address reviewer comments: styling changes + readability

87e9703

Signed-off-by: Karthik Vetrivel <[email protected]>

karthikvetrivel force-pushed the ci/integrate-cherry-pick-bot branch from 7dbcd48 to 87e9703 Compare October 9, 2025 20:04

		const bodyMatches = prBody.matchAll(/\/cherry-pick\s+(release-[\d.]+)/g);
		branches.push(...Array.from(bodyMatches, m => m[1]));

		@@ -0,0 +1,222 @@
		module.exports = async ({ github, context, core }) => {

		@@ -0,0 +1,42 @@
		module.exports = async ({ github, context, core }) => {

	uses: actions/github-script@v7
	uses: actions/github-script@v8

	execSync(`git checkout -b ${backportBranch} ${targetBranch}`, { stdio: 'inherit' });
	execSync(`git checkout ${backportBranch} \|\| git checkout -b ${backportBranch} ${targetBranch}`, { stdio: 'inherit' });```

	const bodyMatches = prBody.matchAll(/\/cherry-pick\s+(release-\d+\.\d+(?:\.\d+)?)/g);
	// Strict ASCII, anchored; allow X.Y or X.Y.Z
	const bodyMatches = prBody.matchAll(/^\/cherry-pick\s+(release-\d+\.\d+(?:\.\d+)?)/gmi);

	4. Push the resolution: \`git push origin ${backportBranch}\`
	4. Push the resolution: \`git push -f origin ${backportBranch}\`

Integrate bot for cherry-picking / backporting commits to release branches #1767

Are you sure you want to change the base?

Integrate bot for cherry-picking / backporting commits to release branches #1767

Conversation

karthikvetrivel commented Oct 8, 2025

Usage

What Happens

Example

Conflict Handling

Branch Naming

Example

Uh oh!

cdesiniotis left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karthikvetrivel Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ArangoGutierrez left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tariq1890 Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karthikvetrivel commented Oct 8, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karthikvetrivel Oct 8, 2025 •

edited

Loading

tariq1890 Oct 8, 2025 •

edited

Loading

elezar left a comment •

edited

Loading