feat: Add automatic backporting to staging for deployment workflows

.github/actions/backport/action.yml

@@ -0,0 +1,144 @@
+name: 'Backport Branch'
+description: 'Create a backport PR from one branch to another'
+author: 'Aligent'
+
+inputs:
+  target-branch:
+    description: 'Target branch to backport to'
+    required: false
+    default: 'staging'
+  source-branch:
+    description: 'Source branch to backport from (defaults to current branch)'
+    required: false
+    default: ''
+  title-prefix:
+    description: 'Prefix for PR title'
+    required: false
+    default: 'Backport:'
+
+outputs:
+  pr-url:
+    description: 'URL of the created or existing PR'
+    value: ${{ steps.backport.outputs.pr-url }}
+  status:
+    description: 'Status of the backport: created, exists, up-to-date, or skipped'
+    value: ${{ steps.backport.outputs.status }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Backport
+      id: backport
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        TARGET_BRANCH: ${{ inputs.target-branch }}
+        SOURCE_BRANCH: ${{ inputs.source-branch || github.ref_name }}
+        TITLE_PREFIX: ${{ inputs.title-prefix }}
+        REPO: ${{ github.repository }}
+        ACTOR: ${{ github.actor }}
+        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |
+        set -euo pipefail
+
+        echo "::group::Validating source branch"
+
+        # Only allow backporting from production-like branches
+        ALLOWED_BRANCHES="production main master"
+        if ! echo "$ALLOWED_BRANCHES" | grep -qw "$SOURCE_BRANCH"; then
+          echo "Skipping backport: source branch '${SOURCE_BRANCH}' is not a production branch"
+          echo "Allowed branches: ${ALLOWED_BRANCHES}"
+          echo "status=skipped" >> $GITHUB_OUTPUT
+          echo "::endgroup::"
+          exit 0
+        fi
+        echo "Source branch '${SOURCE_BRANCH}' is valid for backporting"
+
+        echo "::endgroup::"
+
+        echo "::group::Validating branches"
+
+        # Check if target branch exists
+        if ! gh api "repos/${REPO}/branches/${TARGET_BRANCH}" --silent 2>/dev/null; then
+          echo "::error::Target branch '${TARGET_BRANCH}' does not exist"
+          exit 1
+        fi
+        echo "Target branch exists: ${TARGET_BRANCH}"
+
+        # Check if source branch exists
+        if ! gh api "repos/${REPO}/branches/${SOURCE_BRANCH}" --silent 2>/dev/null; then
+          echo "::error::Source branch '${SOURCE_BRANCH}' does not exist"
+          exit 1
+        fi
+        echo "Source branch exists: ${SOURCE_BRANCH}"
+
+        echo "::endgroup::"
+
+        echo "::group::Checking for existing PR"
+
+        EXISTING_PR=$(gh pr list --repo "${REPO}" --base "${TARGET_BRANCH}" \
+          --head "${SOURCE_BRANCH}" --json url --jq '.[0].url // empty')
+
+        if [ -n "${EXISTING_PR}" ]; then
+          echo "PR already exists: ${EXISTING_PR}"
+          echo "pr-url=${EXISTING_PR}" >> $GITHUB_OUTPUT
+          echo "status=exists" >> $GITHUB_OUTPUT
+          echo "::endgroup::"
+          exit 0
+        fi
+        echo "No existing PR found"
+
+        echo "::endgroup::"
+
+        echo "::group::Checking for changes"
+
+        COMPARE=$(gh api "repos/${REPO}/compare/${TARGET_BRANCH}...${SOURCE_BRANCH}" \
+          --jq '{ahead: .ahead_by, status: .status}')
+        AHEAD_BY=$(echo "${COMPARE}" | jq -r '.ahead')
+
+        if [ "${AHEAD_BY}" -eq 0 ]; then
+          echo "No commits to backport (branches are identical)"
+          echo "status=up-to-date" >> $GITHUB_OUTPUT
+          echo "::endgroup::"
+          exit 0
+        fi
+        echo "Found ${AHEAD_BY} commit(s) to backport"
+
+        echo "::endgroup::"
+
+        echo "::group::Creating backport PR"
+
+        PR_TITLE="${TITLE_PREFIX} ${SOURCE_BRANCH} → ${TARGET_BRANCH}"
+        PR_BODY=$(cat <<EOF
+        ## Backport PR
+
+        This PR backports changes from \`${SOURCE_BRANCH}\` to \`${TARGET_BRANCH}\`.
+
+        ### Details
+        - **Source Branch:** \`${SOURCE_BRANCH}\`
+        - **Target Branch:** \`${TARGET_BRANCH}\`
+        - **Commits:** ${AHEAD_BY}
+        - **Triggered by:** @${ACTOR}
+        - **Workflow Run:** ${RUN_URL}
+
+        ### Instructions
+        1. Review the changes
+        2. Resolve any conflicts if present
+        3. Approve and merge when ready
+
+        *This PR was automatically created by the backport action.*
+        EOF
+        )
+
+        PR_URL=$(gh pr create \
+          --repo "${REPO}" \
+          --base "${TARGET_BRANCH}" \
+          --head "${SOURCE_BRANCH}" \
+          --title "${PR_TITLE}" \
+          --body "${PR_BODY}")
+
+        echo "Created PR: ${PR_URL}"
+        echo "pr-url=${PR_URL}" >> $GITHUB_OUTPUT
+        echo "status=created" >> $GITHUB_OUTPUT
+
+        echo "::endgroup::"

.github/workflows/aio-app-deployment.yml

@@ -30,6 +30,18 @@ on:
         required: false
         default: false
 
+      # Backport Configuration
+      create-backport-pr:
+        description: Create a backport PR to staging after deployment
+        type: boolean
+        required: false
+        default: false
+      backport-target-branch:
+        description: Target branch for backport PR
+        type: string
+        required: false
+        default: staging
+
 jobs:
   deploy:
     name: Deploy AIO App
@@ -105,3 +117,9 @@ jobs:
           AIO_PROJECT_WORKSPACE_NAME: ${{ vars.AIO_PROJECT_WORKSPACE_NAME }}
           VERBOSE: ${{ inputs.debug && '--verbose' || '' }}
         run: aio app deploy${VERBOSE:+ $VERBOSE}
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}

.github/workflows/aio-mesh-deployment.yml

@@ -45,6 +45,18 @@ on:
         required: false
         default: false
 
+      # Backport Configuration
+      create-backport-pr:
+        description: Create a backport PR to staging after deployment
+        type: boolean
+        required: false
+        default: false
+      backport-target-branch:
+        description: Target branch for backport PR
+        type: string
+        required: false
+        default: staging
+
 jobs:
   deploy:
     name: Deploy API Mesh
@@ -186,3 +198,9 @@ jobs:
 
       - name: Describe mesh
         run: aio api-mesh:describe
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}

.github/workflows/gadget-deploy.yml

@@ -31,6 +31,16 @@ on:
         type: boolean
         default: false
 
+      # Backport Configuration
+      create-backport-pr:
+        description: "Create a backport PR to staging after deployment"
+        type: boolean
+        default: false
+      backport-target-branch:
+        description: "Target branch for backport PR"
+        type: string
+        default: "staging"
+
     secrets:
       gadget-api-token:
         description: "Gadget API token"
@@ -142,3 +152,9 @@ jobs:
         env:
           INPUTS_APP_NAME: ${{ inputs.app-name }}
           INPUTS_ENVIRONMENT_NAME: ${{ inputs.environment-name }}
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}

.github/workflows/magento-cloud-deploy.yml

@@ -45,6 +45,18 @@ on:
         required: false
         default: false
 
+      # Backport Configuration
+      create-backport-pr:
+        description: "Create a backport PR to staging after deployment"
+        type: boolean
+        required: false
+        default: false
+      backport-target-branch:
+        description: "Target branch for backport PR"
+        type: string
+        required: false
+        default: "staging"
+
     secrets:
       magento-cloud-cli-token:
         description: "Magento Cloud CLI token for authentication"
@@ -369,3 +381,9 @@ jobs:
           GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           SECRETS_CST_REPORTING_TOKEN_INPUT: ${{ secrets.cst-reporting-token }}
           SECRETS_CST_REPORTING_TOKEN: ${{ secrets.CST_REPORTING_TOKEN }}
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}

.github/workflows/nx-serverless-deployment.yml

@@ -26,6 +26,19 @@ on:
         type: boolean
         required: false
         default: false
+
+      # Backport Configuration
+      create-backport-pr:
+        description: "Create a backport PR to staging after deployment"
+        type: boolean
+        required: false
+        default: false
+      backport-target-branch:
+        description: "Target branch for backport PR"
+        type: string
+        required: false
+        default: "staging"
+
     secrets:
       AWS_SECRET_ACCESS_KEY:
         required: false
@@ -197,3 +210,9 @@ jobs:
           DEBUG: ${{ inputs.debug }}
 
           STEPS_REPO_TYPE_OUTPUTS_IS_MONOREPO: ${{ steps.repo-type.outputs.is_monorepo }}
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}

.github/workflows/pwa-deployment.yml

@@ -96,6 +96,18 @@ on:
         required: false
         default: false
 
+      # Backport Configuration
+      create-backport-pr:
+        description: "Create a backport PR to staging after deployment"
+        type: boolean
+        required: false
+        default: false
+      backport-target-branch:
+        description: "Target branch for backport PR"
+        type: string
+        required: false
+        default: "staging"
+
     outputs:
       deployment-url:
         description: "URL of the deployed application"
@@ -529,3 +541,9 @@ jobs:
           INPUTS_BUILD_COMMAND: ${{ inputs.build-command }}
           INPUTS_BUILD_DIRECTORY: ${{ inputs.build-directory }}
           INPUTS_PREVIEW_MODE: ${{ inputs.preview-mode }}
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}

.github/workflows/s3-deploy.yml

@@ -39,6 +39,19 @@ on:
         description: "AWS Access Key ID"
         type: string
         required: true
+
+      # Backport Configuration
+      create-backport-pr:
+        description: "Create a backport PR to staging after deployment"
+        type: boolean
+        required: false
+        default: false
+      backport-target-branch:
+        description: "Target branch for backport PR"
+        type: string
+        required: false
+        default: "staging"
+
     secrets:
       aws-secret-access-key:
         description: "AWS Secret Access Key"
@@ -84,3 +97,9 @@ jobs:
           INPUTS_S3_PATH: ${{inputs.s3-path}}
           INPUTS_EXTRA_ARGS: ${{inputs.extra-args}}
           INPUTS_DELETE_FLAG: ${{ inputs.delete-flag }}
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}

.github/workflows/shopify-deploy.yml

@@ -29,6 +29,16 @@ on:
         type: boolean
         default: false
 
+      # Backport Configuration
+      create-backport-pr:
+        description: "Create a backport PR to staging after deployment"
+        type: boolean
+        default: false
+      backport-target-branch:
+        description: "Target branch for backport PR"
+        type: string
+        default: "staging"
+
     secrets:
       shopify_cli_token:
         description: 'Shopify CLI authentication token'
@@ -86,3 +96,9 @@ jobs:
         env:
           SHOPIFY_CLI_TOKEN: ${{ secrets.shopify_cli_token }}
           SHOPIFY_FLAG_PATH: ${{ inputs.working-directory }}
+
+      - name: Backport to staging
+        if: success() && inputs.create-backport-pr
+        uses: aligent/workflows/.github/actions/backport@main
+        with:
+          target-branch: ${{ inputs.backport-target-branch }}