Run the backport bot in CI

A pull request labelled needs-backport now opens its own backport pull
requests when it merges, so the seven branch case needs nobody at a keyboard

Two jobs, and the split is the point. analyze is the only job that reaches the
model and it has contents: read. publish is the only job that can write and it
never reaches the model. Repository content, which the model reads, is
therefore never handled by a job holding a token that could change the
repository. The verdict moves between them as an artifact

The workflow assumes its own AwsLcGitHubActionsBackportOidcRole, pinned by
job_workflow_ref to this one file, and that role is what chains into the
shared AwsLcGitHubActionsBedrockRole that #3376 renamed for exactly this. The
bot cannot borrow autofix's role and general CI cannot borrow either

In CI the checkout already is aws/aws-lc, so the branches have nowhere else to
go. --push-to-aws-lc says so out loud, is refused anywhere else, and
push_branch will only ever push a branch named backport-, so the escape has
two independent limits rather than one

The checkout is the merge commit, never the pull request head, so no
untrusted code runs

Author: tianyiy-tim

.github/workflows/backport-bot.yml

@@ -0,0 +1,105 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+#
+# Backport bot. When a pull request labelled needs-backport merges, work out which
+# supported release branches still need the fix and open one pull request each.
+#
+# Split into two jobs on purpose. `analyze` is the only job that talks to the model,
+# and it has no write access. `publish` is the only job that can write, and it never
+# talks to the model. So repository content, which the model reads, is never handled
+# by a job holding a token that could change the repository.
+#
+# The OIDC role is pinned to this file by job_workflow_ref in
+# tests/ci/cdk/cdk/aws_lc_github_oidc_stack.py, so renaming this file breaks the
+# trust policy until the CDK stack is redeployed.
+name: backport-bot
+
+on:
+  pull_request_target:
+    types: [closed]
+
+permissions: {}
+
+jobs:
+  analyze:
+    name: analyze
+    # Only merged pull requests, and only when somebody asked for a backport. Reading
+    # the label here rather than in the tool keeps the decision with the reviewers
+    if: >-
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'needs-backport')
+    permissions:
+      id-token: write # to assume the Bedrock role
+      contents: read
+    runs-on:
+      - codebuild-aws-lc-ci-github-actions-${{ github.run_id }}-${{ github.run_attempt }}
+        image:linux-5.0
+        instance-size:small
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # The merge commit, not the pull request head, so no untrusted code runs
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          # Brings every branch, which is how the tool sees the release branches, and
+          # the whole history, which it needs to compare them
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Load shared Bedrock settings
+        # For configure-aws-credentials, which takes no region input and reads
+        # AWS_REGION from the environment. No model id is set here: the tool reads
+        # the same shared file itself
+        run: |
+          jq -r '"AWS_REGION=\(.aws_region)"' \
+            .github/workflows/ai-config.json >> "$GITHUB_ENV"
+      - uses: ./.github/actions/configure-aws-credentials
+        with:
+          oidcRole: AwsLcGitHubActionsBackportOidcRole
+          roleName: AwsLcGitHubActionsBedrockRole
+      - name: Install the AI client
+        run: pip3 install --user anthropic boto3
+      - name: Work out which branches need the fix
+        run: |
+          util/backport/backport analyze \
+            --commit "${{ github.event.pull_request.merge_commit_sha }}" --skip
+      - name: Keep the verdict for the publish job
+        uses: actions/upload-artifact@v4
+        with:
+          name: backport-run
+          path: util/backport/.backport-runs/last-run.json
+          if-no-files-found: error
+
+  publish:
+    name: publish
+    needs: analyze
+    permissions:
+      contents: write # to push the backport branches
+      pull-requests: write # to open and comment on the backport pull requests
+    runs-on:
+      - codebuild-aws-lc-ci-github-actions-${{ github.run_id }}-${{ github.run_attempt }}
+        image:linux-5.0
+        instance-size:small
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          fetch-depth: 0
+          # persist-credentials is left alone here, unlike in analyze: this job pushes
+          # the backport branches, and it is the checkout's credentials that do it
+      - name: Take the verdict from the analyze job
+        uses: actions/download-artifact@v4
+        with:
+          name: backport-run
+          path: util/backport/.backport-runs
+      - name: Cherry-pick and open the pull requests
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # cherry-pick needs an author, and a runner has no git identity
+          git config user.name "aws-lc-backport-bot"
+          git config user.email "backport-bot@users.noreply.github.com"
+          # --push-to-aws-lc because in CI the checkout is aws/aws-lc itself,
+          # so the backport branches have nowhere else to go
+          util/backport/backport apply --yes
+          util/backport/backport publish \
+            --pr "${{ github.event.pull_request.number }}" \
+            --push-to-aws-lc --yes

tests/ci/cdk/cdk/aws_lc_github_oidc_stack.py

@@ -93,6 +93,34 @@ def __init__(
                                               },
                                           }))
 
+        # The backport bot gets its own OIDC role, pinned to its own workflow file the
+        # same way autofix's role is above. Without a role of its own, any workflow in
+        # the repository could assume it and reach the shared Bedrock role below
+        backport_oidc_role_name = "AwsLcGitHubActionsBackportOidcRole"
+        self.backport_oidc_role = iam.Role(self, id=backport_oidc_role_name, role_name=backport_oidc_role_name,
+                                           assumed_by=iam.WebIdentityPrincipal(self.oidc_provider.attr_arn, {
+                                               "StringEquals": {
+                                                   "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+                                               },
+                                               "StringLike": {
+                                                   "token.actions.githubusercontent.com:sub": "repo:{}/{}:*".format(
+                                                       GITHUB_REPO_OWNER, (
+                                                           STAGING_GITHUB_REPO_NAME
+                                                           if (env.account == PRE_PROD_ACCOUNT)
+                                                           else GITHUB_REPO_NAME
+                                                       )
+                                                   ),
+                                                   "token.actions.githubusercontent.com:job_workflow_ref":
+                                                       "{}/{}/.github/workflows/backport-bot.yml@*".format(
+                                                           GITHUB_REPO_OWNER, (
+                                                               STAGING_GITHUB_REPO_NAME
+                                                               if (env.account == PRE_PROD_ACCOUNT)
+                                                               else GITHUB_REPO_NAME
+                                                           )
+                                                       ),
+                                               },
+                                           }))
+
         ecr_repos = [ecr.Repository.from_repository_name(self, x.replace('/', '-'), repository_name=x)
                      for x in ECR_REPOS]
 
@@ -116,9 +144,13 @@ def __init__(
             block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
         )
 
+        # The shared Bedrock role. Autofix and the backport bot both assume it, each
+        # through its own pinned OIDC role, so neither can borrow the other's
         self.bedrock_role = create_bedrock_role(
-            self, "AwsLcGitHubActionsBedrockRole", env, self.autofix_oidc_role)
+            self, "AwsLcGitHubActionsBedrockRole", env,
+            [self.autofix_oidc_role, self.backport_oidc_role])
         self.bedrock_role.grant_assume_role(self.autofix_oidc_role)
+        self.bedrock_role.grant_assume_role(self.backport_oidc_role)
 
         self.autofix_upload_role = create_autofix_upload_role(
             self, "AwsLcGitHubActionAutofixUploadRole", self.autofix_oidc_role,
@@ -334,9 +366,10 @@ def create_standard_github_actions_role(scope: Construct, id: str,
 
 def create_bedrock_role(scope: Construct, id: str,
                         env: typing.Union[Environment, typing.Dict[str, typing.Any]],
-                        principal: iam.IPrincipal) -> iam.Role:
+                        principals: typing.List[iam.IPrincipal]) -> iam.Role:
     return iam.Role(scope, id, role_name=id,
-                    assumed_by=iam.SessionTagsPrincipal(principal),
+                    assumed_by=iam.CompositePrincipal(
+                        *[iam.SessionTagsPrincipal(p) for p in principals]),
                     inline_policies={
                         "bedrock_policy": iam.PolicyDocument(
                             statements=[

util/backport/README.md

@@ -204,11 +204,12 @@ util/backport/backport apply --open-pr
 | `--pr` | source pull request number, linked in each body and given a summary comment |
 | `--remote` | fork remote the branches are pushed to, `origin` by default |
 | `--dry-run` | print what would be pushed and opened, touch nothing |
+| `--push-to-aws-lc` | let branches be pushed to `aws/aws-lc`. For CI only |
 | `--yes` | skip the confirm, for scripts and CI |
 
 Branches go to your fork; the pull requests are opened against `aws/aws-lc`. Pushing
-to `aws/aws-lc` is refused outright, so a stray `--remote` cannot put half-reviewed
-work on the real repository.
+branches to `aws/aws-lc` is refused unless `--push-to-aws-lc` asks for it, which only
+CI does, so a stray `--remote` cannot put half-reviewed work on the real repository.
 
 **Example Output:**
 
@@ -239,6 +240,44 @@ Nothing is ever a draft and nothing is auto-merged. Re-running is safe: a branch
 already has a pull request is left alone, and finishing a conflict by hand is enough
 to let the next run pick it up, with no need to run `apply` again.
 
+## Running In CI
+
+`.github/workflows/backport-bot.yml` does the same three steps automatically. It fires
+when a pull request labelled `needs-backport` merges, so the decision to backport stays
+with the reviewers rather than with the tool.
+
+It runs as two jobs, and the split is the point:
+
+| Job | Can reach the model | Can write to the repo |
+| --- | --- | --- |
+| `analyze` | yes, `id-token: write` for Bedrock | no, `contents: read` |
+| `publish` | no | yes, `contents: write` and `pull-requests: write` |
+
+The model reads repository content, so the job that reads it is never the job holding a
+token that could change it. The verdict travels between them as an artifact.
+
+Branches are pushed to `aws/aws-lc` itself, because in CI the checkout already is
+`aws/aws-lc`. That needs `--push-to-aws-lc`, which is refused everywhere else,
+and `push_branch` will only ever push a `backport-` branch, so the escape cannot reach
+anything else.
+
+The workflow assumes `AwsLcGitHubActionsBackportOidcRole`, which the OIDC stack pins to
+this exact workflow file by `job_workflow_ref`. Renaming the file breaks the trust
+policy until the CDK stack is redeployed. That role is the only thing allowed to chain
+into the shared `AwsLcGitHubActionsBedrockRole`, alongside autofix's own OIDC role.
+
+### Before the bot can run
+
+Two things have to be true first, and neither is settled by merging this code.
+
+The role has to exist. CDK takes the role name from the construct id, so
+`tests/ci/cdk` has to be deployed before the workflow can assume it. Until then the
+`analyze` job fails at the credentials step.
+
+A pull request opened with `GITHUB_TOKEN` does not start any workflow, so the backport
+pull requests arrive with no CI of their own. Getting them tested needs a token that is
+not `GITHUB_TOKEN`, which is a decision about secrets rather than about this tool.
+
 ## Configuration
 
 ### Model settings
@@ -333,6 +372,9 @@ util/backport/
     .backport-worktrees/          # where a conflicted pick waits, not checked in
 ```
 
+The CI half of the tool lives outside this folder, in
+`.github/workflows/backport-bot.yml` and `tests/ci/cdk/cdk/aws_lc_github_oidc_stack.py`.
+
 ## Testing
 
 ### Unit tests
@@ -489,6 +531,9 @@ Backport branches belong on a fork; only the pull requests go to `aws/aws-lc`. P
 util/backport/backport publish --remote origin
 ```
 
+CI is the one exception: it runs inside `aws/aws-lc` already, and passes
+`--push-to-aws-lc` to say so.
+
 ### Wrong or empty results from a subdirectory
 
 Should not happen. The tool pins itself to the checkout it lives in rather than

util/backport/src/commands/publish.py

@@ -184,7 +184,7 @@ def cmd_publish(args) -> int:
 
     # Checked before anything is printed, so nobody confirms a run that cannot work
     require_gh()
-    push_slug = require_push_remote(args.remote)
+    push_slug = require_push_remote(args.remote, args.push_to_aws_lc)
 
     repo = base_repo("upstream")
     print(f"Fix {run['fix'][:10]}")

util/backport/src/main.py

@@ -84,6 +84,11 @@ def add_publish(subparsers) -> None:
         action="store_true",
         help="say what would be pushed and opened, without doing it",
     )
+    p.add_argument(
+        "--push-to-aws-lc",
+        action="store_true",
+        help="let branches be pushed to aws/aws-lc. For CI, which runs there already",
+    )
     p.add_argument(
         "--yes",
         action="store_true",

util/backport/src/util/github.py

@@ -6,14 +6,14 @@
 Kept in one place so publish and resolve cannot grow two different PR openers
 """
 
-from util.config import BackportError
+from util.config import BACKPORT_BRANCH_PREFIX, BackportError
 from util.git import git, run
 
 import re
 import shutil
 from typing import List, Optional, Tuple
 
-# The repo backports are reviewed in. Branches are never pushed here, only PRs opened
+# Where the pull requests are opened. Branches only go here when CI says so
 AWS_LC_REPO = "aws/aws-lc"
 
 _SLUG = re.compile(r"github\.com[:/]+([^/]+)/([^/]+?)(?:\.git)?/?$")
@@ -60,16 +60,18 @@ def remote_slug(remote: str) -> Optional[str]:
     return f"{found.group(1)}/{found.group(2)}" if found else None
 
 
-def require_push_remote(remote: str) -> str:
+def require_push_remote(remote: str, allow_aws_lc: bool = False) -> str:
     """
     Checks a remote is somewhere we are allowed to push branches
-    Returns its owner/repo. aws/aws-lc is refused: backport branches belong on a fork,
-    and pushing them there would put half-reviewed work on the real repository
+    Returns its owner/repo. aws/aws-lc is refused unless allow_aws_lc is set, which
+    only CI does: running there, the checkout already is aws/aws-lc, so the branches
+    have nowhere else to go. Locally the refusal stands, so a stray --remote cannot
+    put half-reviewed work on the real repository
     """
     slug = remote_slug(remote)
     if slug is None:
         raise BackportError(f"no remote called '{remote}' in this checkout.")
-    if slug.lower() == AWS_LC_REPO:
+    if slug.lower() == AWS_LC_REPO and not allow_aws_lc:
         raise BackportError(
             f"remote '{remote}' is {slug}, which is where the pull requests go, not\n"
             "  where the branches go. Push to your fork instead, with --remote."
@@ -104,7 +106,11 @@ def push_branch(remote: str, branch: str) -> Optional[str]:
     """
     Pushes one local branch to the remote
     Returns None on success or the git error, so one bad branch cannot stop the rest
+    Anything not named backport- is refused, so even the CI run that is allowed to
+    push to aws/aws-lc can only push branches this tool built
     """
+    if not branch.startswith(BACKPORT_BRANCH_PREFIX):
+        raise BackportError(f"refusing to push '{branch}': not a backport branch.")
     pushed = git(
         "push", "--force-with-lease", remote, f"{branch}:{branch}", check=False
     )

util/backport/testing/test_engine.py

@@ -1531,5 +1531,58 @@ def test_a_good_run_returns_the_url(self):
         self.assertEqual(detail, "http://pr/9")
 
 
+class PushToAwsLcEscape(unittest.TestCase):
+    # CI runs inside aws/aws-lc, so the branches have nowhere else to go. That escape
+    # has to be explicit, and it must not weaken the local refusal
+
+    def test_ci_may_push_to_aws_lc(self):
+        with mock.patch.object(github, "remote_slug", lambda r: "aws/aws-lc"):
+            got = github.require_push_remote("origin", allow_aws_lc=True)
+        self.assertEqual(got, "aws/aws-lc")
+
+    def test_the_refusal_still_stands_by_default(self):
+        with mock.patch.object(
+            github, "remote_slug", lambda r: "aws/aws-lc"
+        ), self.assertRaises(config.BackportError):
+            github.require_push_remote("origin")
+
+    def test_a_missing_remote_is_still_an_error_even_for_ci(self):
+        with mock.patch.object(
+            github, "remote_slug", lambda r: None
+        ), self.assertRaises(config.BackportError):
+            github.require_push_remote("nope", allow_aws_lc=True)
+
+
+class PushOnlyBackportBranches(unittest.TestCase):
+    # The escape above means a bug here could push anything to the real repository, so
+    # the branch name is checked too. Two independent limits, not one
+
+    def test_a_backport_branch_is_pushed(self):
+        pushed = []
+
+        def record(*args, **kwargs):
+            # Records the call, so a silent no-push cannot pass as a success
+            pushed.append(args)
+            return completed()
+
+        with mock.patch.object(github, "git", record):
+            error = github.push_branch("origin", "backport-fips-2024-09-27-abc")
+        self.assertIsNone(error)
+        self.assertEqual(len(pushed), 1)
+
+    def test_anything_else_is_refused_before_git_runs(self):
+        with mock.patch.object(github, "git", never_called):
+            for branch in ("main", "fips-2024-09-27", "my-feature"):
+                with self.assertRaises(config.BackportError):
+                    github.push_branch("origin", branch)
+
+    def test_a_failed_push_comes_back_as_text(self):
+        with mock.patch.object(
+            github, "git", lambda *a, **k: completed(returncode=1, stdout="denied")
+        ):
+            got = github.push_branch("origin", "backport-x")
+        self.assertIn("denied", got)
+
+
 if __name__ == "__main__":
     unittest.main()