chore: remove the auto-backport workflow by AlinsRan · Pull Request #469 · api7/api7-ingress-controller

AlinsRan · 2026-09-03T05:41:54Z

What

Deletes .github/workflows/backport.yaml and .github/scripts/backport-commit.sh.

Why

The workflow has failed on every scheduled run since 2026-03-13. It dies in its first step:

Checkout target repository
fatal: could not read Username for 'https://github.com': terminal prompts disabled

secrets.BACKPORT_PAT (last updated 2025-10-17) is expired, and actions/checkout is configured to use it. The last successful run was 2026-03-13T16:09Z; the */30 cron has burned 5,624 failed runs since then (out of 5,640 failures over the workflow's whole lifetime).

Nobody noticed because this is no longer how we backport. Since May we cherry-pick upstream changes per PR by hand, using the (backport apache/apisix-ingress-controller#NNNN) title convention — #463, #464, #465, #466, #467.

Rotating the PAT and resuming it is the worse option:

The watermark variable LAST_BACKPORT_SHA is stuck at f34a259 (2026-03-12), and apache/apisix-ingress-controller master is 56 commits ahead of it. At MAX_COMMITS_PER_RUN: 5 × 48 runs/day, a working PAT would open up to 56 PRs within hours, duplicating the backports already done by hand.
The Process commits step overrides GH_TOKEN with github.token, so the PRs it opens never trigger a workflow. Every backport PR this bot produced landed without CI.
On conflict the script git add . + cherry-pick --continue, i.e. it commits the conflict markers and pushes them. That is where the stale conflict: PRs (conflict: docs: update k8s cluster version in README (#2688) (01fa72f) #376, conflict: chore: update deps (#2698) (d23f7bf) #382, conflict: feat: support custom gatewayproxy namespace for ingressclass (#2701) (b52c26c) #383, conflict: chore: v2.0.1 release (#2700) (3bceaed) #384, fix: ensure upstream scheme is set only if not already defined in HTTP route translation (#2691) (c48e9b3) #386, conflict: chore(deps): bump go.opentelemetry.io/otel/sdk from 1.34.0 to 1.40.0 (#2728) (f34a259) #391) and the 17 leftover backport/* branches came from.

Per-commit auto-cherry-pick is also the wrong granularity here: internal/provider/, internal/adc/client and the Makefile diverge from upstream on purpose, so each backport needs a human decision regardless.

Follow-up (not in this PR)

The LAST_BACKPORT_SHA repository variable and the BACKPORT_PAT secret have no consumer left and can be deleted.
The stale backport/* branches and their open conflict: PRs can be closed separately.

Summary by CodeRabbit

Chores
- Removed automated backport processing and related repository synchronization workflows.
- Removed scheduled and manual backport operations, including conflict handling, pull request creation, and run summaries.

The workflow has failed on every scheduled run since 2026-03-13, when the BACKPORT_PAT it uses for checkout expired: the very first step dies with "could not read Username for 'https://github.com'". At a */30 cron that is roughly 8,300 failed runs. Nobody noticed for half a year because the workflow is no longer how we backport. Since May we cherry-pick upstream changes per PR by hand, with the "(backport apache/apisix-ingress-controller#NNNN)" title convention (#463-#467). Reviving it is not worth it: - The watermark variable LAST_BACKPORT_SHA is stuck at f34a259 (2026-03-12) and upstream master is 56 commits ahead of it, so a working PAT would open up to 56 PRs within hours, duplicating the backports we already did by hand. - The PR-creating step runs with GITHUB_TOKEN, so the PRs it opens never trigger any workflow - every backport PR it produced landed without CI. - On conflict the script commits the conflict markers and pushes anyway, which is where the stale "conflict:" PRs and backport/* branches came from. Per-commit auto-cherry-pick is also the wrong granularity for this repo: our provider/, adc/client and Makefile diverge from upstream on purpose, so every backport needs a human decision anyway. Also drops the LAST_BACKPORT_SHA repository variable's only consumer; the variable and the BACKPORT_PAT secret can be deleted separately.

coderabbitai · 2026-09-03T05:42:55Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 073be214-53db-4074-a2f9-4e3d5cd79f20

📥 Commits

Reviewing files that changed from the base of the PR and between ffcb43e and dc13670.

📒 Files selected for processing (2)

.github/scripts/backport-commit.sh
.github/workflows/backport.yaml

💤 Files with no reviewable changes (2)

.github/workflows/backport.yaml
.github/scripts/backport-commit.sh

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

Walkthrough

The pull request deletes the backport automation script and its GitHub Actions workflow. Repository synchronization, cherry-pick handling, conflict processing, pull-request creation, and cleanup logic are removed.

Changes

Cohort / File(s)	Summary
Backport automation removal `.github/scripts/backport-commit.sh`, `.github/workflows/backport.yaml`	Deletes the backport script and the workflow that scheduled or manually ran upstream synchronization and backport processing.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to dc136

This removes unused automated backporting so releases continue through the established manual cherry-pick PR process. No merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	PASS — The PR only deletes the obsolete backport workflow and its helper script. The exact diff contains 0 additions and 364 deletions in those two files, with no changed application code or tests. Th…
Security Check	✅ Passed	PASS — The pull request changes only two files, and both changes are deletions: `.github/scripts/backport-commit.sh` (214 lines) and `.github/workflows/backport.yaml` (150 lines). No API, database, au…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: removal of the obsolete auto-backport workflow and its supporting automation script.

Full details: E2e Test Quality Review

Explanation

PASS — The PR only deletes the obsolete backport workflow and its helper script. The exact diff contains 0 additions and 364 deletions in those two files, with no changed application code or tests. The removed workflow is repository automation, not an API/service business flow, so E2E scenario coverage, test relationships, assertion readability, mocking, and concurrency checks are not applicable. Active E2E workflows and tests remain, and no references to the removed backport automation remain. The deletion directly matches the stated goal.

Full details: Security Check

Explanation

PASS — The pull request changes only two files, and both changes are deletions: .github/scripts/backport-commit.sh (214 lines) and .github/workflows/backport.yaml (150 lines). No API, database, authorization, TLS, resource-sharing, or secret-resolution code changed. The current tree has no references to the removed automation or its secret/variable names. Category 1 — No issues found. The pull request adds no logging, serialization, or response behavior. Category 2 — No issues found. The pull request adds no database persistence. Category 3 — No issues found. The pull request changes no mutating endpoint or permission check. Category 4 — No issues found. The pull request changes no resource access validation. Category 5 — No issues found. The pull request changes no TLS or cryptographic configuration. Category 6 — No issues found. The pull request changes no shared-resource operation. Category 7 — No issues found. The pull request adds no configuration or secret-reference handling.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/remove-auto-backport-workflow

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-03T05:51:01Z

conformance test report - apisix mode

apiVersion: gateway.networking.k8s.io/v1
date: "2026-09-03T05:50:56Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.6.0
implementation:
  contact:
  - https://github.com/apache/apisix-ingress-controller/issues
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    result: partial
    skippedTests:
    - HTTPRouteHTTPSListener
    - HTTPRouteInvalidBackendRefUnknownKind
    - HTTPRouteInvalidCrossNamespaceBackendRef
    - HTTPRouteInvalidNonExistentBackendRef
    - HTTPRouteListenerHostnameMatching
    - HTTPRouteMultipleGateways
    - HTTPRouteNoBackendRefs
    statistics:
      Failed: 0
      Passed: 30
      Skipped: 7
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - BackendTLSPolicy
    - BackendTLSPolicySANValidation
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRoute303RedirectStatusCode
    - HTTPRoute307RedirectStatusCode
    - HTTPRoute308RedirectStatusCode
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteCORS
    - HTTPRouteNamedRouteRule
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
    - HTTPRouteRetry
    - HTTPRouteRetryBackendTimeout
    - HTTPRouteRetryConnectionError
    - ListenerSet
  name: GATEWAY-HTTP
  summary: Core tests partially succeeded with 7 test skips. Extended tests partially
    succeeded with 1 test skips.
- core:
    result: partial
    skippedTests:
    - GRPCRouteListenerHostnameMatching
    statistics:
      Failed: 0
      Passed: 14
      Skipped: 1
  extended:
    result: success
    statistics:
      Failed: 0
      Passed: 1
      Skipped: 0
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    unsupportedFeatures:
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - ListenerSet
  name: GATEWAY-GRPC
  summary: Core tests partially succeeded with 1 test skips. Extended tests succeeded.
- core:
    result: partial
    skippedTests:
    - TLSRouteHostnameIntersection
    - TLSRouteInvalidBackendRefNonexistent
    - TLSRouteInvalidBackendRefUnknownKind
    - TLSRouteSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 16
      Skipped: 4
  extended:
    result: partial
    skippedTests:
    - TLSRouteTerminateSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 3
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - TLSRouteModeTerminate
    unsupportedFeatures:
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - ListenerSet
    - TLSRouteModeMixed
  name: GATEWAY-TLS
  summary: Core tests partially succeeded with 4 test skips. Extended tests partially
    succeeded with 1 test skips.
succeededProvisionalTests:
- GatewayOptionalAddressValue

github-actions · 2026-09-03T05:51:11Z

conformance test report - apisix-standalone mode

apiVersion: gateway.networking.k8s.io/v1
date: "2026-09-03T05:51:06Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.6.0
implementation:
  contact:
  - https://github.com/apache/apisix-ingress-controller/issues
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    failedTests:
    - HTTPRouteExactPathMatching
    result: failure
    skippedTests:
    - HTTPRouteHTTPSListener
    - HTTPRouteInvalidBackendRefUnknownKind
    - HTTPRouteInvalidCrossNamespaceBackendRef
    - HTTPRouteInvalidNonExistentBackendRef
    - HTTPRouteListenerHostnameMatching
    - HTTPRouteMultipleGateways
    - HTTPRouteNoBackendRefs
    statistics:
      Failed: 1
      Passed: 29
      Skipped: 7
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - BackendTLSPolicy
    - BackendTLSPolicySANValidation
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRoute303RedirectStatusCode
    - HTTPRoute307RedirectStatusCode
    - HTTPRoute308RedirectStatusCode
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteCORS
    - HTTPRouteNamedRouteRule
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
    - HTTPRouteRetry
    - HTTPRouteRetryBackendTimeout
    - HTTPRouteRetryConnectionError
    - ListenerSet
  name: GATEWAY-HTTP
  summary: Core tests failed with 1 test failures. Extended tests partially succeeded
    with 1 test skips.
- core:
    result: partial
    skippedTests:
    - GRPCRouteListenerHostnameMatching
    statistics:
      Failed: 0
      Passed: 14
      Skipped: 1
  extended:
    result: success
    statistics:
      Failed: 0
      Passed: 1
      Skipped: 0
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    unsupportedFeatures:
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - ListenerSet
  name: GATEWAY-GRPC
  summary: Core tests partially succeeded with 1 test skips. Extended tests succeeded.
- core:
    result: partial
    skippedTests:
    - TLSRouteHostnameIntersection
    - TLSRouteInvalidBackendRefNonexistent
    - TLSRouteInvalidBackendRefUnknownKind
    - TLSRouteSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 16
      Skipped: 4
  extended:
    result: partial
    skippedTests:
    - TLSRouteTerminateSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 3
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - TLSRouteModeTerminate
    unsupportedFeatures:
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - ListenerSet
    - TLSRouteModeMixed
  name: GATEWAY-TLS
  summary: Core tests partially succeeded with 4 test skips. Extended tests partially
    succeeded with 1 test skips.
succeededProvisionalTests:
- GatewayOptionalAddressValue

github-actions · 2026-09-03T06:09:32Z

conformance test report

apiVersion: gateway.networking.k8s.io/v1
date: "2026-09-03T06:09:26Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.6.0
implementation:
  contact:
  - https://github.com/apache/apisix-ingress-controller/issues
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    failedTests:
    - GatewayModifyListeners
    - HTTPRouteMultipleGateways
    - HTTPRouteNoBackendRefs
    result: failure
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 3
      Passed: 33
      Skipped: 1
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - BackendTLSPolicy
    - BackendTLSPolicySANValidation
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRoute303RedirectStatusCode
    - HTTPRoute307RedirectStatusCode
    - HTTPRoute308RedirectStatusCode
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteCORS
    - HTTPRouteNamedRouteRule
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
    - HTTPRouteRetry
    - HTTPRouteRetryBackendTimeout
    - HTTPRouteRetryConnectionError
    - ListenerSet
  name: GATEWAY-HTTP
  summary: Core tests failed with 3 test failures. Extended tests partially succeeded
    with 1 test skips.
- core:
    failedTests:
    - GatewayModifyListeners
    result: failure
    statistics:
      Failed: 1
      Passed: 14
      Skipped: 0
  extended:
    result: success
    statistics:
      Failed: 0
      Passed: 1
      Skipped: 0
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    unsupportedFeatures:
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - ListenerSet
  name: GATEWAY-GRPC
  summary: Core tests failed with 1 test failures. Extended tests succeeded.
- core:
    failedTests:
    - GatewayModifyListeners
    - TLSRouteHostnameIntersection
    - TLSRouteInvalidBackendRefNonexistent
    - TLSRouteInvalidBackendRefUnknownKind
    - TLSRouteSimpleSameNamespace
    result: failure
    statistics:
      Failed: 5
      Passed: 15
      Skipped: 0
  extended:
    failedTests:
    - TLSRouteTerminateSimpleSameNamespace
    result: failure
    statistics:
      Failed: 1
      Passed: 3
      Skipped: 0
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - TLSRouteModeTerminate
    unsupportedFeatures:
    - GatewayBackendClientCertificate
    - GatewayFrontendClientCertificateValidation
    - GatewayFrontendClientCertificateValidationInsecureFallback
    - GatewayHTTPListenerIsolation
    - GatewayHTTPSListenerDetectMisdirectedRequests
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - ListenerSet
    - TLSRouteModeMixed
  name: GATEWAY-TLS
  summary: Core tests failed with 5 test failures. Extended tests failed with 1 test
    failures.
succeededProvisionalTests:
- GatewayOptionalAddressValue

Navigation Menu

Uh oh!

chore: remove the auto-backport workflow - #469

chore: remove the auto-backport workflow#469
AlinsRan wants to merge 1 commit into
masterfrom
chore/remove-auto-backport-workflow

AlinsRan commented Sep 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

AlinsRan commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Follow-up (not in this PR)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Sep 3, 2026

conformance test report - apisix mode

Uh oh!

github-actions Bot commented Sep 3, 2026

conformance test report - apisix-standalone mode

Uh oh!

github-actions Bot commented Sep 3, 2026

conformance test report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

AlinsRan commented Sep 3, 2026 •

edited

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading