Onboard new backport-pr re-usable github workflow (custom-codecs)

[peterzhuamazon]

Description

Onboard new backport-pr re-usable github workflow (custom-codecs)

Issues Resolved

opensearch-project/opensearch-build#6270

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 6282dd5.

Path	Line	Severity	Description
.github/workflows/backport.yml	12	critical	The secret OPENSEARCH_CI_BOT_TOKEN is passed to an external reusable workflow pinned to '@main' — a mutable ref that can be changed at any time by anyone with write access to the upstream repo. If that workflow is ever modified (intentionally or via compromise), it can immediately exfiltrate the token. This is a direct credential-exfiltration vector.
.github/workflows/backport.yml	10	high	Supply chain risk: the reusable workflow is referenced as 'opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main' with no pinned commit SHA. The old workflow used commit-pinned actions (e.g., tibdex/github-app-token@1901dc7d, VachaShah/backport@142d3b8a). Switching to an unpinned mutable branch ref removes this supply-chain protection and must be flagged per mandatory policy.
.github/workflows/backport.yml	9	high	The deliberately documented security guard 'github.event.pull_request.merged' was removed. The original code included an explicit comment ('Only react to merged PRs for security reasons') explaining that pull_request_target without this check allows fork PRs to trigger the elevated-permission workflow. Removing this guard means labeling any open fork PR can now trigger the workflow with write permissions and access to repository secrets — a well-known attack path for secret exfiltration via pull_request_target.

The table above displays the top 10 most important findings.

Total: 3 | Critical: 1 | High: 2 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit b8909a0)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 Multiple PR themes Sub-PR theme: Migrate gradle-build-action to gradle/actions/setup-gradle in BWC actions Relevant files: .github/actions/create-bwc-build/action.yaml .github/actions/run-bwc-suite/action.yaml Sub-PR theme: Onboard reusable backport-pr workflow and remove delete-backport-branch workflow Relevant files: .github/workflows/backport.yml .github/workflows/delete-backport-branch.yml

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Latest suggestions up to b8909a0

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Gate backport job to merged PRs only The original workflow only ran on merged PRs (github.event.pull_request.merged) to prevent triggering backports on every unmerged close or label event. The new if condition only checks the repository name, which means the reusable workflow will be invoked for non-merged PR closures and any label event, potentially causing unintended backport attempts or wasted runs. Add the merged condition to gate execution. .github/workflows/backport.yml [9-12] jobs: backport: - if: github.repository == 'opensearch-project/custom-codecs' + if: github.repository == 'opensearch-project/custom-codecs' && github.event.pull_request.merged == true && (github.event.action == 'closed' || (github.event.action == 'labeled' && contains(github.event.label.name, 'backport'))) uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main secrets: OPENSEARCH_CI_BOT_TOKEN: ${{ secrets.OPENSEARCH_CI_BOT_TOKEN }} Suggestion importance[1-10]: 7 __ Why: The original workflow guarded against running on non-merged PRs, and the new reusable workflow invocation removes this check. However, the reusable workflow at opensearch-build may handle this internally, so the concern is valid but uncertain.	Medium
Security	Document pinned action version with comment Pin the third-party action to an immutable, verified release by using a SHA that corresponds to a tagged release and include the version as a comment, consistent with the other pinned actions in this file. This protects against supply-chain risks and makes the intended version auditable. .github/actions/create-bwc-build/action.yaml [36] -uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 +uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3.x.x Suggestion importance[1-10]: 2 __ Why: Adding a version comment is a minor documentation/auditability improvement and does not affect security since the SHA pin is already in place.	Low

---

Previous suggestions

Suggestions up to commit 029c471

Category	Suggestion	Impact
Possible issue	Invoke Gradle separately after setup action gradle/actions/setup-gradle no longer supports the arguments or build-root-directory inputs — those were specific to gradle/gradle-build-action. This step will fail or silently not execute Gradle. Use setup-gradle for setup only and add a separate run step to invoke Gradle in the plugin branch directory. .github/actions/create-bwc-build/action.yaml [35-39] -- name: Build +- name: Setup Gradle uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 with: cache-disabled: true - arguments: assemble -p ${{ inputs.plugin-branch }} +- name: Build + shell: bash + working-directory: ${{ inputs.plugin-branch }} + run: ./gradlew assemble + Suggestion importance[1-10]: 9 __ Why: Correct and important: gradle/actions/setup-gradle v3+ does support arguments input (it's a documented replacement for gradle-build-action), but the -p flag usage and behavior change is worth verifying. The suggestion correctly identifies a potential breaking change in action inputs.	High
	Run Gradle command in separate step Same issue as in create-bwc-build: gradle/actions/setup-gradle does not accept an arguments input, so the BWC tests will not actually be executed. Split into a setup step and a separate run step that invokes ./gradlew with the desired arguments. .github/actions/run-bwc-suite/action.yaml [39-44] -- name: Run BWC tests +- name: Setup Gradle uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 with: cache-disabled: true - arguments: | - -p bwc-test +- name: Run BWC tests + shell: bash + run: ./gradlew -p bwc-test ... + Suggestion importance[1-10]: 8 __ Why: Same concern as suggestion 2 — flags a potential issue with arguments input behavior in setup-gradle. Important to verify, though setup-gradle does accept arguments as a deprecated input for backward compatibility.	Medium
	Restrict backport job to merged PRs The original workflow triggered backport only on merged PRs (closed with merged=true, or labeled with a backport label). The new reusable workflow call has no if filter matching those conditions, so it will run on every closed/labeled event, including unmerged PR closures. Add an if condition matching the original gating logic to avoid attempting backports on unmerged PRs. .github/workflows/backport.yml [8-12] jobs: backport: - if: github.repository == 'opensearch-project/custom-codecs' + if: > + github.repository == 'opensearch-project/custom-codecs' + && github.event.pull_request.merged + && ( + github.event.action == 'closed' + || (github.event.action == 'labeled' && contains(github.event.label.name, 'backport')) + ) uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main secrets: OPENSEARCH_CI_BOT_TOKEN: ${{ secrets.OPENSEARCH_CI_BOT_TOKEN }} Suggestion importance[1-10]: 6 __ Why: The reusable workflow backport-pr.yml@main likely handles the merged-PR gating internally, but the suggestion raises a valid concern about ensuring backports don't run on unmerged PRs. Moderate impact since behavior depends on the reusable workflow.	Low

Suggestions up to commit c43b9b1

Category	Suggestion	Impact
Possible issue	Run Gradle build in separate step gradle/actions/setup-gradle no longer accepts an arguments input to execute Gradle; it only configures Gradle. Passing arguments will be ignored and no build will occur. Use the gradle/actions/setup-gradle action to set up Gradle, then run the build in a separate step via gradle assemble (or invoke ./gradlew). .github/actions/create-bwc-build/action.yaml [35-40] -- name: Build +- name: Setup Gradle uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 with: cache-disabled: true gradle-version: 8.12.1 - arguments: assemble -p ${{ inputs.plugin-branch }} +- name: Build + shell: bash + run: gradle assemble -p ${{ inputs.plugin-branch }} Suggestion importance[1-10]: 8 __ Why: Correct and important: gradle/actions/setup-gradle v3+ deprecated the arguments input; it still works for backward compatibility but the recommended pattern is a separate run step, and this may silently skip the build in newer versions.	Medium
	Invoke Gradle explicitly to run tests Same issue as the build action: setup-gradle does not execute Gradle from an arguments input. The BWC tests will not actually run. Split into a setup step and a run step that invokes Gradle directly. .github/actions/run-bwc-suite/action.yaml [39-47] -- name: Run BWC tests +- name: Setup Gradle uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 with: cache-disabled: true gradle-version: 8.12.1 - arguments: | - -p bwc-test - bwcTestSuite - -Dtests.security.manager=true +- name: Run BWC tests + shell: bash + run: gradle -p bwc-test bwcTestSuite -Dtests.security.manager=true Suggestion importance[1-10]: 8 __ Why: Same valid concern as the build action; using arguments with setup-gradle is deprecated and could cause tests to not execute properly.	Medium
Security	Guard backport job to merged PRs only The reusable workflow likely requires a security gate equivalent to the previous github.event.pull_request.merged and label check, otherwise the backport job will trigger on every closed/labeled event including unmerged PRs. Additionally, calling a reusable workflow requires permissions to be set on the caller job (or inherited via permissions: write-all/secrets: inherit) so that the called workflow can write contents and pull-requests. .github/workflows/backport.yml [8-12] jobs: backport: - if: github.repository == 'opensearch-project/custom-codecs' + if: > + github.repository == 'opensearch-project/custom-codecs' + && github.event.pull_request.merged + && ( + github.event.action == 'closed' + || (github.event.action == 'labeled' && contains(github.event.label.name, 'backport')) + ) + permissions: + contents: write + pull-requests: write uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main secrets: OPENSEARCH_CI_BOT_TOKEN: ${{ secrets.OPENSEARCH_CI_BOT_TOKEN }} Suggestion importance[1-10]: 7 __ Why: Valid concern that the reusable workflow may need merge-state guarding to avoid running on unmerged PR closures, though the reusable workflow itself may already handle this internally.	Medium

Suggestions up to commit 5d9765d

Category	Suggestion	Impact
Possible issue	Actually execute the gradle build The gradle/actions/setup-gradle action only sets up Gradle and does not accept arguments or build-root-directory inputs to execute a build (unlike the deprecated gradle-build-action). Removing build-root-directory and passing arguments will silently skip the actual assemble build. Add an explicit run step that invokes gradle assemble within the plugin branch directory after the setup action. .github/actions/create-bwc-build/action.yaml [35-40] -- name: Build +- name: Setup Gradle uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 with: cache-disabled: true gradle-version: 9.4.1 - arguments: assemble +- name: Build + shell: bash + working-directory: ${{ inputs.plugin-branch }} + run: gradle assemble Suggestion importance[1-10]: 8 __ Why: Correctly identifies that gradle/actions/setup-gradle no longer supports the arguments input for executing builds, which could cause the assemble step to be silently skipped. This is a significant correctness concern, though the reusable action may still handle it via the cache-only mode.	Medium
	Ensure BWC tests actually run gradle/actions/setup-gradle does not run Gradle; the arguments input is ignored, so the BWC test suite will not execute. Split into a setup step followed by an explicit gradle run step that invokes the BWC test suite. .github/actions/run-bwc-suite/action.yaml [39-47] -- name: Run BWC tests +- name: Setup Gradle uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 with: cache-disabled: true gradle-version: 9.4.1 - arguments: | - -p bwc-test - bwcTestSuite - -Dtests.security.manager=true +- name: Run BWC tests + shell: bash + run: | + gradle -p bwc-test bwcTestSuite -Dtests.security.manager=true Suggestion importance[1-10]: 8 __ Why: Same concern as suggestion 1 — setup-gradle does not execute arguments, so the BWC test suite may not run. This is a legitimate and impactful issue worth flagging.	Medium
General	Restore merge and label trigger guards The original workflow only triggered when the PR was merged and (on label events) when the label contained 'backport'. The new reusable-workflow call lacks this gating, so it will run on every closed (including unmerged) and every labeled event regardless of label name. Add an if condition to preserve the merged-only and backport-label gating, unless the reusable workflow performs this check internally. .github/workflows/backport.yml [8-12] jobs: backport: - if: github.repository == 'opensearch-project/custom-codecs' + if: > + github.repository == 'opensearch-project/custom-codecs' + && github.event.pull_request.merged + && ( + github.event.action == 'closed' + || (github.event.action == 'labeled' && contains(github.event.label.name, 'backport')) + ) uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main secrets: OPENSEARCH_CI_BOT_TOKEN: ${{ secrets.OPENSEARCH_CI_BOT_TOKEN }} Suggestion importance[1-10]: 5 __ Why: The concern about losing merge/label gating is valid in principle, but the reusable workflow backport-pr.yml@main likely contains this gating internally, so the suggestion may be unnecessary.	Low

Suggestions up to commit 050182b

Category	Suggestion	Impact
Possible issue	Restrict backport trigger to merged PRs The original workflow had a guard requiring the PR to be merged (github.event.pull_request.merged) and either a closed action or a labeled action with a backport label. Without this guard, the reusable workflow will be invoked on every closed or labeled event, including non-merged closures and unrelated label changes, which can trigger unnecessary runs or unintended behavior. Add an appropriate if condition to filter events before calling the reusable workflow. .github/workflows/backport.yml [8-12] jobs: backport: - if: github.repository == 'opensearch-project/custom-codecs' + if: > + github.repository == 'opensearch-project/custom-codecs' + && github.event.pull_request.merged + && ( + github.event.action == 'closed' + || ( + github.event.action == 'labeled' + && contains(github.event.label.name, 'backport') + ) + ) uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main secrets: OPENSEARCH_CI_BOT_TOKEN: ${{ secrets.OPENSEARCH_CI_BOT_TOKEN }} Suggestion importance[1-10]: 5 __ Why: The suggestion raises a valid concern that the reusable workflow backport-pr.yml may need filtering for merged PRs and backport labels. However, the reusable workflow likely already contains these guards internally, so the impact may be limited. The reviewer cannot verify without seeing the reusable workflow contents.	Low

Suggestions up to commit 15105a1

Category	Suggestion	Impact
Possible issue	Restore merged/labeled event guard condition The original workflow gated execution on github.event.pull_request.merged and the labeled event having a backport label, but the new caller only filters by repository. Without forwarding the original event-trigger condition (or ensuring the reusable workflow enforces it), this will attempt to backport on every closed or labeled PR, including unmerged ones and unrelated labels. .github/workflows/backport.yml [9-10] jobs: backport: - if: github.repository == 'opensearch-project/custom-codecs' + if: | + github.repository == 'opensearch-project/custom-codecs' + && github.event.pull_request.merged + && (github.event.action == 'closed' || (github.event.action == 'labeled' && contains(github.event.label.name, 'backport'))) uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main secrets: OPENSEARCH_CI_BOT_TOKEN: ${{ secrets.OPENSEARCH_CI_BOT_TOKEN }} Suggestion importance[1-10]: 5 __ Why: The reusable workflow backport-pr.yml@main likely enforces the merged/labeled conditions internally, so this may be redundant. However, without verifying the reusable workflow, adding the guard is a reasonable defensive measure.	Low
Security	Pin reusable workflow to commit SHA Referencing a reusable workflow by the mutable @main ref is a supply-chain risk; if upstream main is compromised or changed in a breaking way, this workflow inherits those changes immediately. Pin to a commit SHA (and optionally a version tag comment) for stability and security. .github/workflows/backport.yml [10] -uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@main +uses: opensearch-project/opensearch-build/.github/workflows/backport-pr.yml@<commit-sha> # vX.Y.Z Suggestion importance[1-10]: 4 __ Why: Pinning reusable workflows to a commit SHA is a valid security best practice, though using @main for an internal opensearch-project workflow is a common pattern with lower risk.	Low

[github-actions]

Persistent review updated to latest commit e3220d0

[github-actions]

Persistent review updated to latest commit d1e302b

[github-actions]

Persistent review updated to latest commit b2b2ec4

[github-actions]

Persistent review updated to latest commit c427322

[github-actions]

Persistent review updated to latest commit 15105a1

[github-actions]

Persistent review updated to latest commit 050182b

[github-actions]

Persistent review updated to latest commit 5d9765d

[github-actions]

Persistent review updated to latest commit c43b9b1

[github-actions]

Persistent review updated to latest commit 029c471

[github-actions]

Persistent review updated to latest commit b8909a0