Uh oh!
There was an error while loading. Please reload this page.
Push backport branches via GraphQL createCommitOnBranch (signed commits) - #1937
Merged
Conversation
The repo has an enterprise-level branch ruleset requiring verified
signatures on every ref (`~ALL`), so a normal `git push` of a locally
cherry-picked commit is rejected ("Commits must have verified
signatures"). Replace the `git push` step with a GraphQL
`createCommitOnBranch` mutation, which signs commits automatically
with GitHub's internal key (the same way commits made via the web UI
are signed).
Walks the cherry-pick's diff against the parent (`stable` HEAD),
collects file additions (with binary-safe base64 contents read via
`git cat-file blob`) and deletions, ensures the backport branch
exists on the remote, then runs the mutation. Also updates the manual
conflict-resolution instructions in the failure comment to mention
that local cherry-picks must be signed (`git cherry-pick -S`)
because of the same ruleset.
Caveats:
- Authorship is lost — `createCommitOnBranch` always attributes
commits to the token owner (`github-actions[bot]`). The original
commit SHA is still referenced in the PR body.
- Non-regular files (executable bit, symlinks, submodules) are not
supported by the mutation; the step warns and proceeds with mode
100644 for affected paths.
|
Contributor
Contributor
🧪 E2E Test Results✅ All tests passed Summary
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ 📋 Other
|
Contributor
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 1 step💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 10 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 25 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 50 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 10 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 25 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro workflow with 50 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express Stream Benchmarks(includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) stream pipeline with 5 transform steps (1MB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) 10 parallel streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) fan-out fan-in 10 streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
|
Contributor
No backport to This commit only modifies To override, add the |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the backport.yml workflow to avoid branch ruleset rejections that require verified-signed commits on all refs. Instead of pushing a locally cherry-picked commit (unsigned in CI), it replays the cherry-pick via GitHub’s GraphQL createCommitOnBranch mutation so GitHub produces a verified-signed commit on the backport branch.
Changes:
- Replace
git pushwith a GitHub API–based branch update using GraphQLcreateCommitOnBranch(auto-signed commits). - Improve robustness of PR creation by reusing an existing open backport PR for the same branch instead of failing.
- Update manual conflict-resolution instructions to require signed local cherry-picks (
git cherry-pick -S) due to repo rulesets.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+549
to
+555
| const [, mode, type, blobSha] = match; | ||
| if (type !== 'blob') { | ||
| throw new Error( | ||
| `Unsupported tree entry for ${path}: type=${type} mode=${mode}. ` + | ||
| `GraphQL createCommitOnBranch only supports regular files.`, | ||
| ); | ||
| } |
Comment on lines
+522
to
+526
| const diffOutput = git( | ||
| 'diff', | ||
| '--name-status', | ||
| '-z', | ||
| parentSha, |
pranaygp added a commit
that referenced
this pull request
May 5, 2026
* origin/main: feat: serializable AbortController/AbortSignal (#1301) Auto-remove workflow packages from serverExternalPackages (#1481) Add missing changeset for Zod 4.4.x compatibility fix in @workflow/world (#1939) Push backport branch via GraphQL createCommitOnBranch for signed commits (#1937) Fix backport workflow opencode permission and surface AI failures (#1936) Restructure backport workflow with AI-driven decisions (#1934)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport of PR #1902 (label-triggered) failed with:
The repo has an enterprise-level branch ruleset matching
~ALLthat requires verified signatures on every ref, so a normalgit pushof a locally cherry-picked commit is rejected because CI doesn't have a signing key.This replaces the
git pushstep with a GraphQLcreateCommitOnBranchmutation, which signs commits automatically with GitHub's internal key (the same way commits made via the web UI or bychangesets/actionwithcommitMode: github-apiare signed).Implementation
After the local cherry-pick (with optional AI conflict resolution) succeeds, a new
Push backport branch via GitHub APIstep:git diff --name-status -zbetween the parent (stableHEAD) and the cherry-pick HEAD.git cat-file bloband base64-encodes them into aFileAddition. For each deletion, emits aFileDeletion. Renames are handled asadd(new) + delete(old).backport/<...>branch exists on the remote and points at thestableHEAD (the mutation requires the branch to already exist with the expectedexpectedHeadOid).createCommitOnBranchmutation. GitHub creates a verified-signed commit and updates the branch ref atomically.The subsequent
Create backport PRstep is unchanged.Caveats
createCommitOnBranchalways attributes commits to the token owner (github-actions[bot]), so we lose original-author attribution in the git log. The original commit SHA is still referenced in the PR body.100644for affected paths. This matches the documented limitations of@changesets/ghcommit, which therelease.ymlworkflow uses for its owncommitMode: github-api. Backports involving these file types will need manual signed pushes (the failure-comment instructions now mentiongit cherry-pick -Sfor that).Manual fallback
The
Comment on conflict failurestep's manual instructions are also updated to mention that local cherry-picks must be signed (git cherry-pick -S) because of the same ruleset, and to push to abackport/<...>branch and open a PR rather than pushing directly tostable.