Create Release Plan Pick List workflow

[Copilot]

Adds a workflow_dispatch workflow that automates generating the cherry-pick list for release plan issues, eliminating the manual effort of collecting and ordering PRs from a release project.

Description

• New workflow .github/workflows/release-plan-pick-list.yml
  • Inputs: project_number (az-digital org GitHub Projects v2) and issue_number (az-digital/az_quickstart release plan issue)
  • Aborts with an error message if the project is not a public project
  • Pages through all project items via GraphQL, filtering to PRs in the Done status column
  • Uses full 40-character commit hashes (via GraphQL oid field) throughout
  • Warns and skips PRs with no merge commit (rebase-merged PRs)
  • Sorts az-digital/az_quickstart PRs by mergeCommit.committedDate (oldest → newest; ISO 8601 sorts lexicographically)
  • Posts a comment to the release plan issue containing:
    • ## Pull Requests (in commit order from oldest to newest) — ordered numbered list of az-digital/az_quickstart PRs
    • ## Pull Requests from Other Repositories — ordered numbered list of Done PRs from repositories other than az-digital/az_quickstart (section omitted when none exist)
    • ## Pick List — combined git cherry-pick -x <sha1> <sha2> ... command, plus a second block with one command per commit

Example comment output (project 271 / 3.3.1):

## Pull Requests (in commit order from oldest to newest)

1. #5376
2. #5375
3. #5384
4. #5393
5. #5389
6. #5394
7. #5402
8. #5340
9. #5398
10. #5413
11. #5397
12. #5411
13. #5431
14. #5410
15. #5438
16. #5430
17. #5434
18. #5433
19. #5429
20. #5439
21. #5436
22. #5440
23. #5453
24. #5236

## Pull Requests from Other Repositories

1. az-digital/digital.arizona.edu#72

## Pick List

git cherry-pick -x 8f51ebe5d0848b923f21b833f80822e21683af2e a00b8c796efa460fba68b87d7db39191b9407043 ...

git cherry-pick -x 8f51ebe5d0848b923f21b833f80822e21683af2e
git cherry-pick -x a00b8c796efa460fba68b87d7db39191b9407043
...

Uses REPO_DISPATCH_TOKEN (PAT with read:project org scope) as GH_TOKEN. Sets permissions: {} on the job to restrict the implicit GITHUB_TOKEN.

Release notes

Related issues

How to test

Trigger the workflow manually from the Actions tab with a valid az-digital project number and an az-digital/az_quickstart issue number. Verify the generated comment on the issue contains:

• The az-digital/az_quickstart Done PRs listed in commit order as a numbered list with full 40-character SHAs in the cherry-pick commands
• A separate numbered list of Done PRs from other repositories (if any)
• The combined and per-commit git cherry-pick -x commands

To test the public project check: trigger the workflow with a private project number and verify the workflow aborts with an error message indicating the project is not public.

Types of changes

Arizona Quickstart (install profile, custom modules, custom theme)

• Patch release changes
  • Bug fix
  • Accessibility, performance, or security improvement
  • Critical institutional link or brand change
  • Adding experimental module
  • Update experimental module
• Minor release changes
  • New feature
  • Breaking or visual change to existing behavior
  • Upgrade experimental module to stable
  • Enable existing module by default or database update
  • Non-critical brand change
  • New internal API or API improvement with backwards compatibility
  • Risky or disruptive cleanup to comply with coding standards
  • High-risk or disruptive change (requires upgrade path, risks regression, etc.)
• Other or unknown
  • Other or unknown

Drupal core

• Patch release changes
  • Security update
  • Patch level release (non-security bug-fix release)
  • Patch removal that's no longer necessary
• Minor release changes
  • Major or minor level update
• Other or unknown
  • Other or unknown

Drupal contrib projects

• Patch release changes
  • Security update
  • Patch or minor level update
  • Add new module
  • Patch removal that's no longer necessary
• Minor release changes
  • Major level update
• Other or unknown
  • Other or unknown

Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.
• My change requires release notes.

[joeparsons]

@copilot Please make these changes to the workflow:

• Use full 40-character commit hashes instead of the short versions.
• In the comment to be posted on the release plan issue, add a second list below the Pull Requests list that includes any pull requests in the "Done" column from the project which are from repositories other than az-digital/az_quickstart.

Also, please add an example comment to this PR from running the new workflow using project 271 (3.3.1) so we can review the output.

[Copilot]

@copilot Please make these changes to the workflow:

• Use full 40-character commit hashes instead of the short versions.
• In the comment to be posted on the release plan issue, add a second list be...

Done in commit 38dace1.

• Full 40-character hashes: The workflow already uses the GraphQL oid field which always returns the full 40-character SHA — no code change was needed.
• External repo PR list: A new ## Pull Requests from Other Repositories section is now included in the comment when there are Done PRs from other repositories. The section is omitted when there are none.

---

Here is the example output the workflow would generate for project 271 (3.3.1), based on what was in the Done column at the time the release plan issue was completed:

---

Pull Requests (in commit order from oldest to newest)

• Update drupal/cas requirement from 3.0.0 to 3.0.1 #5376
• Bump actions/upload-artifact from 6.0.0 to 7.0.0 #5375
• Update drupal/diff requirement from 2.0.0-beta4 to 2.0.0-beta5 #5384
• Update drupal/webform requirement from 6.3.0-beta7 to 6.3.0-beta8 #5393
• Update drupal/core-recommended requirement from 11.3.3 to 11.3.5 #5389
• Closes #5392: Back to Top button changes the current URL in the browser #5394
• Closes #5401: Text with .placeholder class is hidden on Add Taxonomy Term forms #5402
• Update drupal/schema_metatag requirement from 3.0.3 to 3.0.4 #5340
• Update drupal/crop requirement from 2.5.0 to 2.6.0 #5398
• Closes #5412: Update Slack links to Teams #5413
• Bump actions/setup-node from 6.2.0 to 6.3.0 #5397
• Closes #5385: Nested anchor tags in az_course.az_card view mode #5411
• Closes #4934: Video player button could use more horizontal spacing in the Text on Media paragraph #5431
• Update drupal/searchstax requirement from 1.9.3 to 1.10.0 #5410
• Closes #5437: AZ Navbar may not work with custom navigation menu blocks #5438
• Bump shivammathur/setup-php from 2.36.0 to 2.37.0 #5430
• Bump actions/cache from 5.0.3 to 5.0.4 #5434
• Bump softprops/action-gh-release from 2.5.0 to 2.6.1 #5433
• Closes #4958: Revert change to composer audit reporting mode for abandoned packages #5429
• Update drupal/menu_link_attributes requirement from 1.6.0 to 1.7.0 #5439
• Update citation-style-language/locales requirement from 0.0.87 to 0.0.88 #5436
• Update Arizona Bootstrap to 5.1.2 #5440
• Closes #5449: Regression in scroll behavior of AJAX views with exposed filters #5453
• Closes #5229: The demo content for the Trellis RFI embed functionality should use a persistent form #5236

Pull Requests from Other Repositories

• Closes #71: Update Slack links to Teams digital.arizona.edu#72

Pick List

git cherry-pick -x 8f51ebe5d0848b923f21b833f80822e21683af2e a00b8c796efa460fba68b87d7db39191b9407043 10bff24eaf3871cf9b99319216c3e9b0558379b2 8e97ed9826b534d7d9989c46fc5cd14fb09d8f7f de14f590cd98950159ddd07d95291c59d71b8f4e e7e8181c2a6994a2edd691ba78d87c58bf599ed6 cefb104b034ef878e33ebf70e23d942c9a47bfa4 86cbb8a3b092caaf9ee9ad939c011d7b2327b352 12a98bc405de8bda04973cc1a690c2e40d91d73a 67f486654062a84bbf466fd1db9d39995cde1f45 7a8e7f9486597dcd4cb4a65830c774d5b597c054 684ba48e36d6945b0d29b97593152be0be14c7ec 4adcad74ffbe7f9bea0e51f7281a2c6dd47bef53 16e599adecffd868770e385506de48570b5e9a4e 4c8629d5a8fee9470f66bff857313b784b02830e e32ef14e32985fff84aad945e17253a75b962aba 5a30a910a685a9a031f82da037a9eddb83f64535 16c79f9ac29f3e734c42f9e08042a7645a50c622 4299af957f42d4cb16e0461f0bf3a7ebd9d00d24 47647489c4f3321718e46caef7ad87d0ac1eb431 c603b5dd0fddf756a6f51513e554a33bf109c13b f5c43b6c08ab2541721973d8546d5c1e69861666 de26e057d6693f2d21c8e743ef0879239388dacb 61f3822290aff7c5d5657163b71dbca34f130011

git cherry-pick -x 8f51ebe5d0848b923f21b833f80822e21683af2e
git cherry-pick -x a00b8c796efa460fba68b87d7db39191b9407043
git cherry-pick -x 10bff24eaf3871cf9b99319216c3e9b0558379b2
git cherry-pick -x 8e97ed9826b534d7d9989c46fc5cd14fb09d8f7f
git cherry-pick -x de14f590cd98950159ddd07d95291c59d71b8f4e
git cherry-pick -x e7e8181c2a6994a2edd691ba78d87c58bf599ed6
git cherry-pick -x cefb104b034ef878e33ebf70e23d942c9a47bfa4
git cherry-pick -x 86cbb8a3b092caaf9ee9ad939c011d7b2327b352
git cherry-pick -x 12a98bc405de8bda04973cc1a690c2e40d91d73a
git cherry-pick -x 67f486654062a84bbf466fd1db9d39995cde1f45
git cherry-pick -x 7a8e7f9486597dcd4cb4a65830c774d5b597c054
git cherry-pick -x 684ba48e36d6945b0d29b97593152be0be14c7ec
git cherry-pick -x 4adcad74ffbe7f9bea0e51f7281a2c6dd47bef53
git cherry-pick -x 16e599adecffd868770e385506de48570b5e9a4e
git cherry-pick -x 4c8629d5a8fee9470f66bff857313b784b02830e
git cherry-pick -x e32ef14e32985fff84aad945e17253a75b962aba
git cherry-pick -x 5a30a910a685a9a031f82da037a9eddb83f64535
git cherry-pick -x 16c79f9ac29f3e734c42f9e08042a7645a50c622
git cherry-pick -x 4299af957f42d4cb16e0461f0bf3a7ebd9d00d24
git cherry-pick -x 47647489c4f3321718e46caef7ad87d0ac1eb431
git cherry-pick -x c603b5dd0fddf756a6f51513e554a33bf109c13b
git cherry-pick -x f5c43b6c08ab2541721973d8546d5c1e69861666
git cherry-pick -x de26e057d6693f2d21c8e743ef0879239388dacb
git cherry-pick -x 61f3822290aff7c5d5657163b71dbca34f130011

---

Note: the example was reconstructed from the data in issue #5388 (the manually-created 3.3.1 release plan) since the workflow requires a REPO_DISPATCH_TOKEN with org-level project read scope and cannot be executed from the PR sandbox.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh auth status (http block)
  • Triggering command: /usr/bin/gh gh api graphql -H Authorization: bearer ****** -f query=query { organization(login: "az-digital") { projectV2(number: 271) { title items(first: 100) { nodes { fieldValueByName(name: "Status") { ... on ProjectV2ItemFieldSingleSelectValue { name (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[joeparsons]

@copilot, please use ordered lists instead of unordered lists for the PR lists created by the workflow.

[Copilot]

@copilot, please use ordered lists instead of unordered lists for the PR lists created by the workflow.

Done in commit 27498ff. Both the ## Pull Requests (in commit order from oldest to newest) list and the ## Pull Requests from Other Repositories list now use ordered (numbered) lists.

[joeparsons]

@copilot Please update the workflow to abort with an error message if the project input is not a public project.

[Copilot]

@copilot Please update the workflow to abort with an error message if the project input is not a public project.

Done in commit 872eedf. The workflow now queries the project's public field before processing items. If the project is not public, it exits with:

Error: Project #<number> ("<title>") is not a public project. This workflow only supports public projects.

[az-digital-bot]

Tugboat has finished building the preview for this pull request!

Link:

• https://pr5458-eqnrihdpxwlwc8w7ttf1disl8zx0epbk.tugboatqa.com

Dashboard:

• https://dashboard.tugboatqa.com/69d031cfd5d87f969e1b0701