[sync-changelog] Assign sync PRs and always run from main by mrodm · Pull Request #21243 · elastic/integrations

mrodm · 2026-09-14T14:39:03Z

Proposed commit message

[sync-changelog] Assign sync PR to the backport PR author or merger

When creating the changelog sync PR, resolve the assignee from the
originating backport PR: use the PR author if they are an elastic org
member, otherwise fall back to whoever merged the PR. If the lookup
fails for any reason, the --assignee flag is omitted so PR creation
is not blocked.

[sync-changelog] Always load action and binary from main

Replace the local ./.github/actions/sync-backport-changelog reference
with elastic/integrations/.github/actions/sync-backport-changelog@main
in both the push and issue_comment jobs, so the action definition is
always fetched from main regardless of which backport branch triggered
the run.

Add an explicit checkout of main inside the action so the Go binary is
also always built from main's cmd/backport, not from a potentially
older backport branch.

[sync-changelog] Use bot flag and write access to resolve sync PR assignee

Replace the elastic org membership check (which required read:org scope
not available on GITHUB_TOKEN) with a collaborator permission check via
GET /repos/{repo}/collaborators/{login}/permission, which works with the
existing contents:write + pull-requests:write permissions.

Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON
so bot detection uses the API's own is_bot flag rather than string
matching. pickAssignee now guards both the author and mergedBy paths:
- Use author if not a bot and has write/maintain/admin access.
- Fall back to mergedBy if not a bot.
- Return empty string (skip --assignee) if neither qualifies.

What and Why

Assignee on sync PRs (cmd/backport/backports/changelog/sync.go)

Changelog sync PRs created by the sync-backport-changelog workflow had no assignee set, leaving them unowned. This change resolves the assignee automatically from the originating backport PR using the following logic:

Fetch the backport PR's author and mergedBy (including is_bot flag) in a single gh pr view call.
Use the author if they are not a bot and have write/maintain/admin access on the repo, checked via GET /repos/{repo}/collaborators/{login}/permission (works with the existing contents:write + pull-requests:write GITHUB_TOKEN permissions).
Otherwise fall back to mergedBy, as long as they are not a bot (the merger always has repo write access by definition).
If neither qualifies (e.g. both are bots), omit --assignee so PR creation is not blocked.

Always run from main (.github/workflows/sync-backport-changelog.yml, .github/actions/sync-backport-changelog/action.yml)

Previously the workflow loaded the composite action from the branch that triggered it (./.github/actions/sync-backport-changelog). Improvements merged to main would not apply to pushes on existing backport branches. This change:

Switches both jobs (push and issue_comment) to reference elastic/integrations/.github/actions/sync-backport-changelog@main.
Adds an explicit actions/checkout@v7 with ref: main inside the action so the Go binary is also always built from main's cmd/backport.
Removes the now-redundant actions/checkout steps from the workflow (the action does its own checkout).

Author's Checklist

pickAssignee is covered by unit tests (TestPickAssignee) including bot-author, external-contributor, and both-bots scenarios.
Verified behaviour against real PRs changelog: security_detection_engine 9.4.12 (backport sync from PR #20998) #21002 and changelog: aws 6.22.0 (backport sync from PR #20972) #21127 — correct assignees resolved in both cases.

How to test this PR locally

Merge a PR into a backport branch that has a changelog.yml change.
Observe that the sync-backport-changelog workflow creates a sync PR with the correct assignee (the PR author if not a bot and has repo write access, otherwise the merger if not a bot).
Alternatively, comment /sync-changelog on a merged backport PR to trigger the retry path and verify the same.

Related issues

This PR was generated with the assistance of Claude (claude-sonnet-4-6).

When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is skipped so PR creation is not blocked. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

Existing backport branches are not migrated and may continue using the old workflow and action.

Pull request overview

Updates changelog sync automation to assign eligible PR owners and consistently use the main branch implementation.

Changes:

Adds bot-aware assignee resolution and tests.
References the composite action from main.
Checks out main before building the Go binary.

File summaries

File	Description
`cmd/backport/backports/changelog/sync.go`	Resolves and applies sync PR assignees.
`cmd/backport/backports/changelog/sync_test.go`	Tests assignee selection scenarios.
`.github/workflows/sync-backport-changelog.yml`	References the action from `main`.
`.github/actions/sync-backport-changelog/action.yml`	Checks out `main` before building.

Review details

Suppressed comments (1)

.github/workflows/sync-backport-changelog.yml:31

This updates only the copy of the workflow on main; existing backport-* branches still execute the workflow file stored on those branches, so they will continue using the old local action (or no workflow) and will not get the promised main-built action/binary. The branch-creation script only copies .github/workflows for newly created branches, so an active-branch migration (or an equivalent bootstrap step) is needed for this change to cover existing branches.

      - uses: elastic/integrations/.github/actions/sync-backport-changelog@main

Files reviewed: 4/4 changed files
Comments generated: 0
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🔵 Needs a closer look

Existing active backport branches are not updated to use the action from main.

Review details

Suppressed comments (1)

.github/workflows/sync-backport-changelog.yml:31

Because GitHub resolves both push and issue_comment workflows from the backport branch, this change only affects branches whose copy of sync-backport-changelog.yml has already been updated. Existing active backport branches still contain the old ./.github/actions/sync-backport-changelog references and will continue running their branch-local action, so the stated “always run from main” guarantee is not true for them. Please include or run the active-branch migration described in #19262, or explicitly scope this change to new/updated branches.

      - uses: elastic/integrations/.github/actions/sync-backport-changelog@main

Files reviewed: 4/4 changed files
Comments generated: 0 new
Review effort level: Lite

infra-vault-gh-plugin-prod · 2026-09-14T17:04:59Z

💚 Build Succeeded

Buildkite Build
Commit: 01c4911

History

💔 Build #49617 failed 2f046ad
💚 Build #49611 succeeded 353759d

cc @mrodm

mergify · 2026-09-15T10:43:58Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

mrodm · 2026-09-16T07:54:48Z

@Mergifyio backport backport-aws-6.x backport-aws-7.1 backport-aws-7.0 backport-aws-7.2 backport-aws-7.3 backport-security_detection_engine-9.4 backport-security_detection_engine-9.3 backport-security_detection_engine-8.19

mergify · 2026-09-16T07:54:59Z

backport backport-aws-6.x backport-aws-7.1 backport-aws-7.0 backport-aws-7.2 backport-aws-7.3 backport-security_detection_engine-9.4 backport-security_detection_engine-9.3 backport-security_detection_engine-8.19

✅ Backports have been created

Details

#21292 [backport-aws-6.x] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-aws-6.x
#21293 [backport-aws-7.1] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-aws-7.1
#21294 [backport-aws-7.0] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-aws-7.0
#21295 [backport-aws-7.2] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-aws-7.2
#21296 [backport-aws-7.3] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-aws-7.3
#21297 [backport-security_detection_engine-9.4] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-security_detection_engine-9.4
#21298 [backport-security_detection_engine-9.3] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-security_detection_engine-9.3
#21299 [backport-security_detection_engine-8.19] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-security_detection_engine-8.19

…21292) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21374) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21375) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21376) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21377) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21378) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

mrodm · 2026-09-17T14:46:30Z

@Mergifyio backport backport-cloud_security_posture-1.0 backport-cloud_security_posture-1.1 backport-cloud_security_posture-1.2 backport-cloud_security_posture-1.3 backport-cloud_security_posture-1.4 backport-cloud_security_posture-1.5 backport-cloud_security_posture-1.7 backport-cloud_security_posture-3.0 backport-cloud_security_posture-3.1 backport-cloud_security_posture-3.2

mergify · 2026-09-17T14:47:56Z

backport backport-cloud_security_posture-1.0 backport-cloud_security_posture-1.1 backport-cloud_security_posture-1.2 backport-cloud_security_posture-1.3 backport-cloud_security_posture-1.4 backport-cloud_security_posture-1.5 backport-cloud_security_posture-1.7 backport-cloud_security_posture-3.0 backport-cloud_security_posture-3.1 backport-cloud_security_posture-3.2

❌ No backport have been created

Details

#21382 [backport-cloud_security_posture-1.0] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-1.0
#21383 [backport-cloud_security_posture-1.1] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-1.1
#21384 [backport-cloud_security_posture-1.2] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-1.2
#21385 [backport-cloud_security_posture-1.3] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-1.3
#21386 [backport-cloud_security_posture-1.4] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-1.4
#21387 [backport-cloud_security_posture-1.5] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-1.5
#21388 [backport-cloud_security_posture-1.7] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-1.7
#21389 [backport-cloud_security_posture-3.0] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-3.0
#21390 [backport-cloud_security_posture-3.1] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-3.1
Backport to branch `` failed

GitHub error: Branch not found

#21391 [backport-cloud_security_posture-3.2] (backport #21243) [sync-changelog] Assign sync PRs and always run from main has been created for branch backport-cloud_security_posture-3.2

…tion Add a paragraph to step 4 explaining that the sync-backport-changelog workflow now automatically assigns the sync PR to the backport PR's author (if not a bot and has write/maintain/admin access) or to the merger (if not a bot). Reflects elastic#21243, merged 2026-09-15. Add a sentence to the checklist comment section documenting that auto-backport PRs are automatically assigned to the original PR's author or merger using the same logic. Preemptive for elastic#21379 (open). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…21382) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21383) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21384) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21385) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21386) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21387) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21388) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21389) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21390) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…21391) [sync-changelog] Assign sync PR to the backport PR author or merger When creating the changelog sync PR, resolve the assignee from the originating backport PR: use the PR author if they are an elastic org member, otherwise fall back to whoever merged the PR. If the lookup fails for any reason, the --assignee flag is omitted so PR creation is not blocked. [sync-changelog] Always load action and binary from main Replace the local ./.github/actions/sync-backport-changelog reference with elastic/integrations/.github/actions/sync-backport-changelog@main in both the push and issue_comment jobs, so the action definition is always fetched from main regardless of which backport branch triggered the run. Add an explicit checkout of main inside the action so the Go binary is also always built from main's cmd/backport, not from a potentially older backport branch. [sync-changelog] Use bot flag and write access to resolve sync PR assignee Replace the elastic org membership check (which required read:org scope not available on GITHUB_TOKEN) with a collaborator permission check via GET /repos/{repo}/collaborators/{login}/permission, which works with the existing contents:write + pull-requests:write permissions. Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON so bot detection uses the API's own is_bot flag rather than string matching. pickAssignee now guards both the author and mergedBy paths: - Use author if not a bot and has write/maintain/admin access. - Fall back to mergedBy if not a bot. - Return empty string (skip --assignee) if neither qualifies. --------- (cherry picked from commit 6bba11e) Co-authored-by: Mario Rodriguez Molins <mario.rodriguez@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…er (#21379) When the auto-backport workflow opens a PR targeting a backport branch, resolve the assignee from the source PR that was merged into main using the same logic introduced for sync-changelog PRs in #21243: - Use the PR author if they are not a bot and have repo write access. - Fall back to whoever merged the PR if the author doesn't qualify (also checked for write access to guard against revoked access post-merge). - Omit --assignee entirely if neither qualifies, so PR creation is not blocked. Resolution logic is centralised in a new cmd/backport/assign package (PRActor, Resolve, Pick) shared by both the apply and changelog/sync code paths, eliminating the duplication that existed between them. The workflow passes the original PR number via --origin-pr-number through backport_apply.sh to the backport binary, which performs the two API calls (gh pr view + collaborator permission check) internally. assign.Resolve is guarded by OpenPR && !DryRun to avoid redundant API calls in non-PR paths. --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

mrodm and others added 2 commits September 14, 2026 15:10

mrodm self-assigned this Sep 14, 2026

mrodm marked this pull request as ready for review September 14, 2026 16:54

mrodm requested a review from a team as a code owner September 14, 2026 16:54

Copilot AI lite review requested due to automatic review settings September 14, 2026 16:54

Copilot started reviewing on behalf of mrodm September 14, 2026 16:55 View session

fix lint for test file

01c4911

Copilot AI reviewed Sep 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 14, 2026 16:58

Copilot started reviewing on behalf of mrodm September 14, 2026 16:59 View session

Copilot AI reviewed Sep 14, 2026

View reviewed changes

teresaromero approved these changes Sep 15, 2026

View reviewed changes

mrodm merged commit 6bba11e into elastic:main Sep 15, 2026
8 checks passed

mrodm mentioned this pull request Sep 15, 2026

backport: deploy backport-branch automation workflows to active backport branches #19262

Closed

5 tasks

mrodm deleted the add_assignee_sync_changelog_main branch September 16, 2026 07:51

mrodm mentioned this pull request Sep 18, 2026

[Docs][Backports] Update developer documentation to reflect new automated backport workflow #20413

Merged

3 tasks done

Navigation Menu

Repository navigation

[sync-changelog] Assign sync PRs and always run from main - #21243

[sync-changelog] Assign sync PRs and always run from main#21243
mrodm merged 4 commits into
elastic:mainfrom
mrodm:add_assignee_sync_changelog_main

mrodm commented Sep 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

infra-vault-gh-plugin-prod Bot commented Sep 14, 2026

Uh oh!

mergify Bot commented Sep 15, 2026

Uh oh!

Uh oh!

mrodm commented Sep 16, 2026

Uh oh!

mergify Bot commented Sep 16, 2026 •

edited

Loading

Uh oh!

mrodm commented Sep 17, 2026

Uh oh!

mergify Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mrodm commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

What and Why

Author's Checklist

How to test this PR locally

Related issues

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (1)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (1)

Uh oh!

infra-vault-gh-plugin-prod Bot commented Sep 14, 2026

💚 Build Succeeded

History

Uh oh!

mergify Bot commented Sep 15, 2026

Uh oh!

Uh oh!

mrodm commented Sep 16, 2026

Uh oh!

mergify Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Backports have been created

Uh oh!

mrodm commented Sep 17, 2026

Uh oh!

mergify Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ No backport have been created

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mrodm commented Sep 14, 2026 •

edited

Loading

mergify Bot commented Sep 16, 2026 •

edited

Loading

mergify Bot commented Sep 17, 2026 •

edited

Loading