build: adopt v0.1.x release branching and backport automation - #23
build: adopt v0.1.x release branching and backport automation#23Roasbeef wants to merge 1 commit into
Conversation
Adopt lnd's trunk-based release model so main can keep moving while a
stable release line lives on a side branch. Fixes flow from main to the
release branch via labeled backports rather than merge freezes.
- .github/workflows/backport.yml cherry-picks a merged main PR onto a
release branch when the PR carries a backport-v<version>-branch label,
opening a draft PR when the cherry-pick conflicts.
- docs/release_branch_management.md and docs/backport-workflow.md
describe the branch model and the backport label flow, adapted to the
Changesets-driven versioning this repo already uses.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| shell: bash | ||
| run: | | ||
| # Extract all backport labels | ||
| labels='${{ toJSON(github.event.pull_request.labels.*.name) }}' |
There was a problem hiding this comment.
Shell injection via label names. The ${{ toJSON(...) }} expression is expanded textually into the run: script before bash executes, and it lands inside a single-quoted string. toJSON escapes double quotes and backslashes but not single quotes, so a PR label whose name contains a ' breaks out of the quoting. For example a label named '$(id)' renders this line as labels='["'$(id)'"]', and $(id) runs as an unquoted command substitution.
Because this workflow runs on pull_request_target with contents: write and the repo GITHUB_TOKEN, this is an arbitrary-code-execution / privilege-escalation vector (a triager who can apply labels but cannot push to protected branches or read secrets could exploit it).
Fix with the standard pattern: pass the value through env: and reference it as a quoted shell variable so it is never spliced into the script text:
- name: Validate target branches exist
id: validate
shell: bash
env:
LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
run: |
# Extract all backport labels
labels="$LABELS"See backport.yml.
| - cherry-picks the commits, | ||
| - opens a new PR targeting the release branch. | ||
|
|
||
| The label can be added before or after the merge — both trigger the workflow. |
There was a problem hiding this comment.
Em-dash character (U+2014) used. CLAUDE.md: "Do not use the em-dash character (U+2014) anywhere in the repo: comments, TSDoc, markdown, UI copy, config, all of it." (CLAUDE.md)
This file contains literal em-dashes on lines 24, 37, 38, 39, 52, 54, and 58 (e.g. this line: "before or after the merge — both trigger the workflow."). Replace each with a colon, comma, parentheses, or two sentences as reads naturally. (The other two added files are clean; the → arrows here are fine.)
|
@Roasbeef, remember to re-request review from reviewers when ready |
2 similar comments
|
@Roasbeef, remember to re-request review from reviewers when ready |
|
@Roasbeef, remember to re-request review from reviewers when ready |
2 participants
Prep for the public v0.1 release: adopt lnd's trunk-based release model so
mainkeeps moving while a stable release line lives onv0.1.x-branch, withfixes flowing back via labeled backports.
What's here
.github/workflows/backport.yml— cherry-picks a mergedmainPR onto arelease branch when it carries a
backport-v<version>-branchlabel (draft PRon conflict).
docs/release_branch_management.md+docs/backport-workflow.md—the branch model and backport flow, adapted to the Changesets-driven
versioning this repo already uses (no Go
build/version.go).No version change on
main: Changesets continues to drive versions here.Follow-ups (out of band)
v0.1.x-branchrelease branch + its0.1.0version PR (setspackages/{core,web,react}to0.1.0).backport-v0.1.x-branchlabel and branch protection.Part of a coordinated v0.1 setup across darepo-client, darepo, swapdk-server,
dawallet, and damobile.