Skip to content

gha: Add release branch sync workflow #7091

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vvoland wants to merge 1 commit into
base: master
Choose a base branch
from
Open

gha: Add release branch sync workflow #7091

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
137 changes: 137 additions & 0 deletions .github/workflows/sync-release-branch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,137 @@
name: Sync Docker release branch

concurrency:
group: ${{ github.workflow }}-${{ github.ref_name }}
cancel-in-progress: false

permissions:
contents: read

on:
workflow_dispatch:
inputs:
tag:
description: Tag to sync from, for example docker-v29.6.0
required: true
type: string
dry_run:
description: Merge but don't push
required: true
default: false
type: boolean

jobs:
sync-release-branch:
runs-on: ubuntu-24.04
permissions:
contents: write
outputs:
base_sha: ${{ steps.sync.outputs.base_sha }}
has_changes: ${{ steps.sync.outputs.has_changes }}
temporary_branch: ${{ steps.sync.outputs.temporary_branch }}
temporary_sha: ${{ steps.sync.outputs.temporary_sha }}
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

- name: Validate
env:
BRANCH: ${{ github.ref_name }}
run: |
if [ "$BRANCH" = "master" ]; then
echo "::error::This workflow is expected to be run on a release branch, not master"
exit 1
fi

- name: Configure git author
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"

- name: Sync release branch to tag range
id: sync
env:
DRY_RUN: ${{ inputs.dry_run }}
RELEASE_BRANCH: ${{ github.ref_name }}
RUN_ATTEMPT: ${{ github.run_attempt }}
RUN_ID: ${{ github.run_id }}
TAG: ${{ inputs.tag }}
Comment thread
vvoland marked this conversation as resolved.
run: |
set -o pipefail
base_sha=$(git rev-parse "origin/$RELEASE_BRANCH")
temporary_branch="process/sync-release-branch/$RUN_ID-$RUN_ATTEMPT"
echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
echo "temporary_branch=$temporary_branch" >> "$GITHUB_OUTPUT"

tags_file=$(mktemp)
scripts/unmerged-tags \
"$RELEASE_BRANCH" \
"$TAG" \
> "$tags_file"

echo >> "$GITHUB_STEP_SUMMARY"
echo "## Tags to sync" >> "$GITHUB_STEP_SUMMARY"
echo >> "$GITHUB_STEP_SUMMARY"
sed 's/^/- /' "$tags_file" >> "$GITHUB_STEP_SUMMARY"

xargs -r scripts/sync-branch < "$tags_file" | tee -a "$GITHUB_STEP_SUMMARY"
Comment thread
vvoland marked this conversation as resolved.
Comment thread
vvoland marked this conversation as resolved.

if [[ "$DRY_RUN" == "true" ]]; then
Comment thread
vvoland marked this conversation as resolved.

@docker-agent docker-agent Jul 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] Dry-run mode still executes git merge operations — it only skips the push

The dry_run input is described as "Print the tag range without merging or pushing," but xargs -r scripts/sync-branch < "$tags_file" on line 80 runs unconditionally — scripts/sync-branch performs real git merge --no-ff operations. The dry-run check on line 82 only prevents the subsequent git push. This means a dry-run invocation performs irreversible (locally) merges in the runner's working tree, which is discarded, but the behavior contradicts the documented intent.

If the intent is to allow a "preview without side effects" run (as the description states), the merge step should be gated:

if [[ "$DRY_RUN" != "true" ]]; then
    xargs -r scripts/sync-branch < "$tags_file" | tee -a "$GITHUB_STEP_SUMMARY"
fi

If instead the intent is "merge but don't push" (a trial merge to validate feasibility), the dry_run description should be updated to say "Merge locally but do not push" to avoid confusion.

Confidence Score
🟡 moderate 75/100

echo "has_changes=false" >> "$GITHUB_OUTPUT"
exit 0
fi

if [[ $(git rev-parse HEAD) == $(git rev-parse "origin/$RELEASE_BRANCH") ]]; then
echo "has_changes=false" >> "$GITHUB_OUTPUT"
echo "No changes to push"
exit 0
fi

echo "has_changes=true" >> "$GITHUB_OUTPUT"
git push origin "HEAD:refs/heads/$temporary_branch"
echo "temporary_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

push-release-branch:
needs: sync-release-branch
if: ${{ !inputs.dry_run && needs.sync-release-branch.outputs.has_changes == 'true' }}
runs-on: ubuntu-24.04
environment: docker-releases
permissions:
contents: write
timeout-minutes: 10
steps:
- name: Checkout release
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

- name: Push release branch
env:
BASE_SHA: ${{ needs.sync-release-branch.outputs.base_sha }}
RELEASE_BRANCH: ${{ github.ref_name }}
TEMPORARY_BRANCH: ${{ needs.sync-release-branch.outputs.temporary_branch }}
TEMPORARY_SHA: ${{ needs.sync-release-branch.outputs.temporary_sha }}
run: |
git fetch origin "$RELEASE_BRANCH"
current_sha=$(git rev-parse "origin/$RELEASE_BRANCH")
if [[ "$current_sha" != "$BASE_SHA" ]]; then
echo "$RELEASE_BRANCH changed from $BASE_SHA to $current_sha"
exit 1
fi

git fetch origin "$TEMPORARY_BRANCH"
current_temporary_sha=$(git rev-parse FETCH_HEAD)
if [[ "$current_temporary_sha" != "$TEMPORARY_SHA" ]]; then
echo "$TEMPORARY_BRANCH changed from $TEMPORARY_SHA to $current_temporary_sha"
exit 1
fi

git push origin "FETCH_HEAD:$RELEASE_BRANCH"

- name: Delete temporary branch
env:
TEMPORARY_BRANCH: ${{ needs.sync-release-branch.outputs.temporary_branch }}
run: git push origin --delete "$TEMPORARY_BRANCH"
34 changes: 34 additions & 0 deletions scripts/sync-branch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
#!/usr/bin/env bash
# Merge the given release tags.
set -Eeuo pipefail

if [[ $# -lt 1 ]]; then
echo "usage: $0 [--dry-run] TAG..." >&2
exit 1
fi

tags_to_sync=("$@")

for tag_to_sync in "${tags_to_sync[@]}"; do
if git merge --no-ff "$tag_to_sync"; then
continue
fi

if ! git rev-parse --verify --quiet MERGE_HEAD > /dev/null || git diff --quiet --diff-filter=U; then

@docker-agent docker-agent Jul 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] Wrong boolean operator || vs && in merge-conflict guard may cause unexpected exit

The condition on line 17 is:

if ! git rev-parse --verify --quiet MERGE_HEAD > /dev/null || git diff --quiet --diff-filter=U; then
    exit 1
fi

Due to operator precedence this evaluates as:

(NOT in_merge_state) OR (no_unresolved_conflicts)

The guard's intent is to abort when something truly unexpected happened — i.e., when we are not in a merge state AND there are no unresolved conflicts. With ||, the condition is also true when MERGE_HEAD is absent alone, or when there are no unresolved conflicts alone. The problematic edge case: if a merge fails and MERGE_HEAD is present but auto-resolution leaves no U-status files (e.g., all conflicts were trivially resolved but merge still exited non-zero), git diff --quiet --diff-filter=U exits 0 (no output), making the overall condition FALSE OR TRUE = TRUE → the script exits 1 even though the state is a valid in-progress merge.

The intent is better expressed with && — exit only when BOTH conditions indicate an unexpected state:

Suggested change
if ! git rev-parse --verify --quiet MERGE_HEAD > /dev/null || git diff --quiet --diff-filter=U; then
if ! git rev-parse --verify --quiet MERGE_HEAD > /dev/null && git diff --quiet --diff-filter=U; then
Confidence Score
🟡 moderate 75/100

@vvoland vvoland Jul 8, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if if git can auto-resolve everything the git merge exits with 0?

@docker-agent docker-agent Jul 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're absolutely right — I misunderstood the merge behavior. If git merge auto-resolves all conflicts successfully, it exits 0, so the script would never reach this guard in the first place.

Looking at this again, the guard is only reached when git merge exits non-zero (line 16), which happens when:

  1. There are unresolved conflicts requiring manual intervention, OR
  2. Something went wrong (e.g., uncommitted changes blocking the merge)

In case (1), MERGE_HEAD exists and git diff --diff-filter=U shows conflicts. In case (2), MERGE_HEAD typically doesn't exist. So the current || logic makes sense: exit if we're not in a valid merge state (no MERGE_HEAD) or if there are no conflicts to resolve (unexpected given the non-zero exit).

My analysis was flawed — the existing condition correctly handles the expected failure modes. Thank you for catching that!

exit 1
fi

git checkout "$tag_to_sync" -- '.'
git add --all
Comment thread
vvoland marked this conversation as resolved.
git merge --continue
done

# Check that every tag is in the branch.
Comment thread
vvoland marked this conversation as resolved.
# This catches cases where a merge did not actually incorporate one of the
# requested release tags.
for tag_to_sync in "${tags_to_sync[@]}"; do
if ! git merge-base --is-ancestor "$tag_to_sync" HEAD; then
echo "tag $tag_to_sync is not contained in $(git rev-parse --abbrev-ref HEAD)" >&2
exit 1
fi
done
38 changes: 38 additions & 0 deletions scripts/unmerged-tags
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
#!/usr/bin/env bash
set -Eeuo pipefail

if [[ $# -ne 2 ]]; then
echo "usage: $0 <RELEASE_BRANCH> <TAG>" >&2
exit 1
fi

release_branch="$1"
tag="$2"

if [[ "$tag" == *"-rc."* ]]; then
echo "error: RC tags cannot be used as sync targets" >&2
exit 1
fi
Comment thread
vvoland marked this conversation as resolved.

if ! git rev-parse --verify --quiet "refs/tags/$tag" > /dev/null; then
echo "error: Tag $tag does not exist" >&2
exit 1
fi

# Return early the requested tag is already merged into release branch.
if git merge-base --is-ancestor "$tag" "$release_branch"; then
exit 0
fi

if git rev-parse --verify --quiet upstream/master > /dev/null 2>&1; then
master="upstream/master"
else
master="origin/master"
fi

# Get all docker release tags merged into master but not into release branch
git tag --merged "$master" --no-merged "$release_branch" \
| grep '^v' \
| grep -v -- "-rc." \
| sort -V \
| awk -v tag="$tag" '{print} $0==tag{exit}'
Comment thread
vvoland marked this conversation as resolved.