From e927009cbdb884a15f5a8e40e37e07f278e6f4de Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Fri, 23 Oct 2026 10:06:54 -0700
Subject: [PATCH] automation: act on landed edera/6.18-lts backports from
 edera/mainline

When a backport pull request merges into edera/6.18-lts, delete its
branch and retry the mainline pull requests waiting for it.

A backport/edera-6.18-lts/pr-<N> branch is the automation's own and is
of no use once its pull request has merged, but delete_branch_on_merge
stays off so feature branches survive, and the merged ones pile up. It
is deleted only if it still points at the commit that merged.

The retry was meant to happen already, from lts-backport-merged.yml on
edera/6.18-lts, but that has never run: pull_request_target always takes
the workflow from the default branch. This copy of that path lives on
edera/mainline and runs edera/6.18-lts's retry-backports.sh.
---
 .github/workflows/lts-backport-merged.yml | 91 +++++++++++++++++++++++
 1 file changed, 91 insertions(+)
 create mode 100644 .github/workflows/lts-backport-merged.yml

diff --git a/.github/workflows/lts-backport-merged.yml b/.github/workflows/lts-backport-merged.yml
new file mode 100644
index 00000000000000..28216e494ce41b
--- /dev/null
+++ b/.github/workflows/lts-backport-merged.yml
@@ -0,0 +1,91 @@
+name: Landed edera/6.18-lts backport
+
+# Runs when a backport/edera-6.18-lts/pr-<N> pull request merges into
+# edera/6.18-lts:
+#
+#   - deletes its branch, as long as it still points at the commit that
+#     merged. The repository keeps delete_branch_on_merge off so feature
+#     branches survive, and these branches are the automation's own:
+#     lts-backport.yml on edera/6.18-lts makes a new one if a backport is
+#     ever proposed again;
+#   - dispatches every mainline pull request labelled backport-waiting
+#     again, since what it was waiting for may just have landed
+#     (retry-backports.sh, as edera/6.18-lts has it). The nightly retries
+#     them too; this just saves the wait.
+#
+# pull_request_target always runs this file as it is on the default branch,
+# edera/mainline, whichever branch the pull request targets, which is why it
+# lives here. edera/6.18-lts's copy of this path never runs. Nothing here
+# checks out or runs the pull request's code.
+
+on:
+  pull_request_target:
+    types: [closed]
+    branches: [edera/6.18-lts]
+
+permissions: {}
+
+jobs:
+  delete:
+    if: >-
+      github.event.pull_request.merged
+      && github.event.pull_request.head.repo.full_name == github.repository
+      && startsWith(github.event.pull_request.head.ref, 'backport/edera-6.18-lts/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Delete the branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          # Only the commit that merged: a branch that has moved since holds
+          # something newer, and is left alone.
+          if ! cur=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/$HEAD_REF" -q .object.sha 2>/dev/null); then
+            echo "\`$HEAD_REF\` is already gone." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          if [ "$cur" != "$HEAD_SHA" ]; then
+            echo "::warning::Not deleting $HEAD_REF: it is at ${cur:0:12}, not the merged ${HEAD_SHA:0:12}."
+            exit 0
+          fi
+          gh api -X DELETE "repos/$GITHUB_REPOSITORY/git/refs/heads/$HEAD_REF"
+          echo "Deleted \`$HEAD_REF\` (\`${HEAD_SHA:0:12}\`)." >> "$GITHUB_STEP_SUMMARY"
+
+  retry:
+    if: >-
+      github.event.pull_request.merged
+      && github.event.pull_request.head.repo.full_name == github.repository
+      && startsWith(github.event.pull_request.head.ref, 'backport/edera-6.18-lts/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: edera/6.18-lts
+          persist-credentials: false
+          sparse-checkout: .github
+
+      - name: Retry waiting backports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash .github/scripts/retry-backports.sh