backport bot

[asvetlov]

@webknjaz FYI

I've disabled (suspended) patchback bot for the sake of Backport action.
I'm fine with any solution but the action leaves comments in PR if backport is succeeded or failed.
The last is super important, I'd like to see a message if automatic backport is not possible and I should do it manually.
This feature is missed in patchback; that's why I cannot use it. If the bot supports it -- I'm open to try and use it again.

Thanks for understanding.

[webknjaz]

@asvetlov currently, patchback reports its status via Checks API on the PR where the backport was requested. Example: https://github.com/aio-libs/aiohttp/pull/4993/checks?check_run_id=1259218345.

I do, however, have a feature request for posting comments too: sanitizers/patchback-github-app#13. It's coming from the @ansible-collections where I started battle-testing patchback initially. I just haven't gotten to implementing it. It'll require a bit of refactoring to co-exist with Checks seamlessly, though. That's why it's not there yet.

Let's revisit this once the feature is implemented. Also, if you have any additional feature requests, feel free to file them at https://github.com/sanitizers/patchback-github-app/issues/new too.

[webknjaz]

The FR has been implemented. Also, it seems like that backport action is rather broken now.

[webknjaz]

Based on the above, I've unsuspended patchback.

[asvetlov]

Disabling chronographer for particular request by adding a label, e. g. bot:chronographer:skip would be great :)
Also, regarding backport I can imagine two things:

1. Setup a custom per-project labels for created pull request, as the backport action supports: https://github.com/aio-libs/aiohttp/blob/master/.github/workflows/backport.yml#L37
2. Automerge if configured (or label provided) PR when it has all required check passed (e.g. backport PR is approved and required checks are green). This functionality can be provided by a separate github app, as I've configured autosquash + backport actions in separate workflows.

The CPython bot can automerge, it saves time for core devs: after approving and merging the main PR I monitor it for 20-30 seconds to make sure that all required backport PRs are created (or something has failed, both events are reported as comments). After that I go to generated backport PRs and approve them without waiting for CI and pressing "merge" for backports. It is very handy, the bot merges 95% of backports without additional human intervention.

[webknjaz]

Disabling chronographer for particular request by adding a label, e. g. bot:chronographer:skip would be great :)

Urgh... Right. I'll get to it one day. I believe there's a tracking issue for that in the repo already.

1. Setup a custom per-project labels for created pull request, as the backport action supports: master/.github/workflows/backport.yml#L37

The tracking issue is sanitizers/patchback-github-app#12.

2. Automerge if configured (or label provided) PR when it has all required check passed (e.g. backport PR is approved and required checks are green). This functionality can be provided by a separate github app, as I've configured autosquash + backport actions in separate workflows.

The CPython bot can automerge, it saves time for core devs: after approving and merging the main PR I monitor it for 20-30 seconds to make sure that all required backport PRs are created (or something has failed, both events are reported as comments). After that I go to generated backport PRs and approve them without waiting for CI and pressing "merge" for backports. It is very handy, the bot merges 95% of backports without additional human intervention.

Yeah, that's totally understandable. Too bad that miss-islington is hitting its rate limits already.
You are right, it's better to have automerging set up separately, and is imperative for it to rely on human approvals: the native dependabot incarnation has removed automerges because blind merges make repos vulnerable to the supply chain attacks.

[webknjaz]

Urgh... Right. I'll get to it one day. I believe there's a tracking issue for that in the repo already.

bot:chronographer:skip is supported now.

[webknjaz]

@Dreamsorcerer do you want to explore GHA based automerge setup for the backports?

[Dreamsorcerer]

Probably not. :P Going to try and finish off some other things.

I assume we would only want to automerge if the bot is successful? If a user has to fix conflicts, automerging without review would be an obvious way to insert malicious code.

[webknjaz]

Yep. The condition would be if the backport PR was created by a bot.