Backport workflow (akuity/kargo)

The Backport workflow from akuity/kargo, explained and optimized by Latchkey.

CI health: A - excellent

Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: akuity/kargo.github/workflows/backport.yamlLicense Apache-2.0View source

What it does

This is the Backport workflow from the akuity/kargo repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: Backport

on:
  pull_request_target:
    types: [closed, labeled]

permissions:
  contents: read

jobs:
  pull-request:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    if: github.repository_owner == 'akuity' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport/', github.event.label.name))
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        allow-unsafe-pr-checkout: true
    - name: Create backport PRs
      uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
      # xref: https://github.com/korthout/backport-action#inputs
      with:
        # Use token to allow workflows to be triggered for the created PR
        github_token: ${{ secrets.AKUITYBOT_PAT }}
        # Match labels with pattern `backport/<target-branch>`
        label_pattern: '^backport\/([^ ]+)$'
        # A title which matches the linter constraints for semantic PR titles,
        # while still being descriptive about the target branch
        pull_title: 'chore(backport ${target_branch}): ${pull_title}'
        # Simpler PR description than default
        pull_description: |-
          Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.
        # Copy any labels (excluding those starting with "backport/") to the backport PR
        copy_labels_pattern: '^(?!backport\/).*'
        # Copy associated people to the backport PR
        copy_assignees: true
        copy_requested_reviewers: true
        # Copy any milestone to the backport PR
        copy_milestone: true
        # Skip any merge commits in the source PR
        merge_commits: 'skip'
        # Automatically detect "squash and merge" instead of copying all
        # commits from the source PR to the backport PR
        experimental: >
          {
            "detect_merge_method": true
          }

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Backport
 
on:
  pull_request_target:
    types: [closed, labeled]
 
permissions:
  contents: read
 
jobs:
  pull-request:
    timeout-minutes: 30
    runs-on: latchkey-small
    permissions:
      contents: write
      pull-requests: write
    if: github.repository_owner == 'akuity' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport/', github.event.label.name))
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit
 
    - name: Checkout
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        allow-unsafe-pr-checkout: true
    - name: Create backport PRs
      uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
      # xref: https://github.com/korthout/backport-action#inputs
      with:
        # Use token to allow workflows to be triggered for the created PR
        github_token: ${{ secrets.AKUITYBOT_PAT }}
        # Match labels with pattern `backport/<target-branch>`
        label_pattern: '^backport\/([^ ]+)$'
        # A title which matches the linter constraints for semantic PR titles,
        # while still being descriptive about the target branch
        pull_title: 'chore(backport ${target_branch}): ${pull_title}'
        # Simpler PR description than default
        pull_description: |-
          Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.
        # Copy any labels (excluding those starting with "backport/") to the backport PR
        copy_labels_pattern: '^(?!backport\/).*'
        # Copy associated people to the backport PR
        copy_assignees: true
        copy_requested_reviewers: true
        # Copy any milestone to the backport PR
        copy_milestone: true
        # Skip any merge commits in the source PR
        merge_commits: 'skip'
        # Automatically detect "squash and merge" instead of copying all
        # commits from the source PR to the backport PR
        experimental: >
          {
            "detect_merge_method": true
          }

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

step-security/harden-runner actions/checkout