chore(backport): Add backport GH workflow to Scanner repo

[dcaravel]

Copied from stackrox/stackrox https://github.com/stackrox/stackrox/blob/943c70ededfe015e7397037d59fcaf09539975ed/.github/workflows/backport-pr.yaml

Adding a backport label to a PR, once merged, will yield a backport PR against the target branch.

Assumes secret RHACS_BOT_GITHUB_TOKEN is setup at the org level (currently not setup at the repo level)

Will test / iterate as needed once merged.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Added automated backporting for merged pull requests marked with a backport label.
  • Backport pull requests are created automatically against the appropriate release branch with a standardized title.

Walkthrough

Adds a GitHub Actions workflow that runs the pinned tibdex/backport action for merged pull requests and merged pull requests labeled for backporting.

Changes

Backport workflow

Layer / File(s)	Summary
Backport workflow configuration .github/workflows/backport-pr.yaml	Adds pull_request_target triggers for qualifying merged and labeled events, then invokes tibdex/backport with the bot token and a templated pull request title.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the added backport GitHub Actions workflow for the Scanner repo.
Description check	✅ Passed	The description matches the change by explaining the copied backport workflow and its secret requirement.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dc/scanner-backporter

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dcaravel]

/retest

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/backport-pr.yaml (2)

24-24: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Update tibdex/backport to v3 to fix the Node 16 deprecation warning.

tibdex/backport@v2.0.4 runs on Node 16, which is deprecated in GitHub Actions and generates warnings. Version 3 runs on Node 20 and resolves this issue.

Since your repository uses ratchet to pin SHAs, you can update the line to @v3 and then run your ratchet tooling to resolve and pin the new exact SHA.

♻️ Proposed update

-      - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # ratchet:tibdex/backport@v2.0.4
+      - uses: tibdex/backport@v3 # ratchet:tibdex/backport@v3

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/backport-pr.yaml at line 24, Update the tibdex/backport
action in the workflow from v2.0.4 to v3, then run the repository’s ratchet
tooling to replace the tag with the corresponding exact commit SHA while
preserving the existing ratchet annotation.

---

14-22: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Prevent workflow from running on all merged PRs.

The current condition triggers the backport job for every single merged PR, regardless of whether it requires backporting. For PRs without a backport label, tibdex/backport gracefully exits, but it still consumes CI minutes and litters the Actions history.

You can filter the closed event to only run if a backport label is already present by joining the PR's label names.

⚡ Proposed optimization

     if: >
       github.event.pull_request.merged
       && (
-        github.event.action == 'closed'
-        || (
+        (
+          github.event.action == 'closed'
+          && contains(join(github.event.pull_request.labels.*.name, ','), 'backport')
+        ) || (
           github.event.action == 'labeled'
           && contains(github.event.label.name, 'backport')
         )
       )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/backport-pr.yaml around lines 14 - 22, Update the workflow
trigger condition around the backport job so the merged pull request’s
closed-event path also requires a backport label, using the pull request label
names for the check. Preserve the existing labeled-event behavior and
merged-status requirement, while preventing unlabeled merged PRs from starting
the workflow.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/backport-pr.yaml:
- Line 24: Update the tibdex/backport action in the workflow from v2.0.4 to v3,
then run the repository’s ratchet tooling to replace the tag with the
corresponding exact commit SHA while preserving the existing ratchet annotation.
- Around line 14-22: Update the workflow trigger condition around the backport
job so the merged pull request’s closed-event path also requires a backport
label, using the pull request label names for the check. Preserve the existing
labeled-event behavior and merged-status requirement, while preventing unlabeled
merged PRs from starting the workflow.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1e1c3bc5-a819-43d9-8837-c41f0695e1d4

📥 Commits

Reviewing files that changed from the base of the PR and between 011f22f and 9ca626a.

📒 Files selected for processing (1)

• .github/workflows/backport-pr.yaml

[github-actions]

/retest scanner-on-push

[openshift-ci]

@github-actions[bot]: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

Details

In response to this:

/retest scanner-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[BradLugo]

LGTM. One more note: we need to create the labels in the format the tibdex/backport action is expecting.