Add CI check to block PRs targeting backplane branches - #323
Conversation
Backplane branches are synced from main via fast-forward (ffwd-branch.yaml). Direct PRs to these branches are not needed and can cause divergence. This workflow fails with a clear error message directing contributors to target main instead. Ref: ARO-27157 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that blocks pull requests targeting branches matching ChangesBranch Protection Workflow
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/protect-backplane-branches.yaml:
- Around line 4-6: The workflow's pull_request trigger only matches branches
"backplane-*" but doesn't include the edited event type, so PR base-branch
retargeting can bypass the job; update the pull_request trigger to include the
edited event (e.g., add types: [opened, synchronize, reopened, edited] under
pull_request) so that events like PR retargeting against backplane-* branches
will run the protection check; modify the trigger definition that currently
references "pull_request" and branch pattern "backplane-*" (the pull_request:
branches: - "backplane-*") to include the edited type.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 8ca1aa03-0d81-4a05-ae7d-62ab2848ed0a
📒 Files selected for processing (1)
.github/workflows/protect-backplane-branches.yaml
Self-review finding addressed before external review. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/protect-backplane-branches.yaml (1)
3-6:⚠️ Potential issue | 🟠 Major | ⚖️ Poor tradeoffInclude
editedevent type to prevent bypass via PR retargeting.The workflow only triggers on the default
pull_requesttypes. If a contributor opens a PR targetingmain, then later retargets it to abackplane-*branch, theeditedevent fires but this workflow won't run, allowing the protection to be bypassed.GitHub Actions pull_request event default types and does retargeting base branch trigger edited type🔒 Proposed fix to include edited event type
on: pull_request: branches: - "backplane-*" + types: + - opened + - reopened + - synchronize + - edited🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/protect-backplane-branches.yaml around lines 3 - 6, The workflow triggers only on the default pull_request events and omits the edited type, which allows PRs retargeted to backplane-* branches to bypass the check; update the on: pull_request block (the existing pull_request trigger that filters branches "backplane-*") to include the edited event (e.g., add types: [edited] or include edited alongside other types) so that retargeting a PR into a backplane-* branch will run this workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/protect-backplane-branches.yaml:
- Around line 3-6: The workflow triggers only on the default pull_request events
and omits the edited type, which allows PRs retargeted to backplane-* branches
to bypass the check; update the on: pull_request block (the existing
pull_request trigger that filters branches "backplane-*") to include the edited
event (e.g., add types: [edited] or include edited alongside other types) so
that retargeting a PR into a backplane-* branch will run this workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 6ce04bdb-a255-48a9-b9c3-4ec5eeb79a96
📒 Files selected for processing (1)
.github/workflows/protect-backplane-branches.yaml
AI Review Pipeline Summary
Accepted Findings
All CodeRabbit threads resolved: Yes. PR description updated: Already current (no changes made). 🤖 Generated by |
The original backplane-* glob also blocks PRs to backplane-2.x branches which are still actively maintained. Restrict to backplane-5* as intended by ARO-27157. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: marek-veber, RadekCap The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2 participants
Summary
backplane-*branchesmainvia fast-forward (ffwd-branch.yaml), so direct PRs are unnecessary and can cause divergencemaininsteadeditedevent type to catch PRs retargeted to backplane branchespermissions: {}for minimal token scopeRef: ARO-27157
Test plan
backplane-5.0— verify theblockjob fails with the error messagebackplane-5.0— verify it also triggers the blockmainmainare unaffected🤖 Generated with Claude Code
Summary by CodeRabbit