feat: add hotfix auto-tagging and template generation workflows by Devinwong · Pull Request #8131 · Azure/AgentBaker

Devinwong · 2026-03-19T20:57:51Z

What this PR does / why we need it:
Add hotfix auto-tagging and template generation workflows.

Developer per-hotfix effort:

Fix the bugs, cherry-pick to main.
This PR automates the steps for hot fixing the official release branch.

Tried to separate from production codes because this is only for script hotfix PR generation, and probably won't last too long once we get aks-node-controller hotfix available.

Which issue(s) this PR fixes:

Fixes #

Copilot

Pull request overview

Adds automation to support hotfix workflows for official/** release branches by generating scriptless-template overrides and auto-creating hotfix tags.

Changes:

Introduces hack/hotfix-generate.sh to detect changed parts/linux/cloud-init/artifacts/** files and inject matching write_files blocks into parts/linux/cloud-init/nodecustomdata.yml’s EnableScriptlessCSECmd section.
Adds a GitHub Actions workflow to run the generator, run make generate, and commit/push the updated template + snapshot testdata.
Adds a GitHub Actions workflow to auto-tag hotfix releases on official/** branches.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
`hack/hotfix-generate.sh`	New generator script that maps changed artifacts to `cloudInitData` variable keys and injects the corresponding `write_files` blocks into the scriptless template section.
`.github/workflows/hotfix-generate.yml`	Workflow to run the generator on PRs/label events, run `make generate`, and commit/push generated updates.
`.github/workflows/hotfix-autotag.yml`	Workflow to create/push incrementing `v0.<date>.<patch>` tags for `official/**` branches.

.github/workflows/hotfix-generate.yml

.github/workflows/hotfix-autotag.yml

.github/workflows/hotfix-generate.yml

…te generation

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

hack/hotfix-generate.sh

.github/workflows/hotfix-autotag.yml

hack/hotfix-generate.sh

…decustomdata.yml

…tialization scripts

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

.github/workflows/hotfix-autotag.yml

.github/workflows/hotfix-generate.yml

…-tag workflow

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

hack/hotfix_generate.py

.github/workflows/hotfix-generate.yml

Uses the same GitHub App token pattern as tidy.yaml to produce verified/signed commits that satisfy branch protection rules. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Uses go-version-file to match the repo's pinned Go version. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

.github/workflows/hotfix-generate.yml

.github/workflows/hotfix-autotag.yml

@v6

- Upgrade checkout@v4 → @v6 in both hotfix workflows - Upgrade setup-go@v5 → @v6 - Stage manifest.json in commit step (generated by make generate) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replaces git commit + git push with GitHub Git Data API calls (create tree → create commit → update ref). This produces a single atomic commit that is automatically signed/verified by GitHub, satisfying branch protection requirements. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

.github/workflows/hotfix-generate.yml

…roving script output

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Copilot · 2026-03-20T23:18:36Z

.github/workflows/hotfix-generate.yml

+      - name: Commit changes via API
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          FILE="parts/linux/cloud-init/nodecustomdata.yml"
+          if git diff --quiet "$FILE"; then
+            echo "No template changes needed."
+            exit 0
+          fi
+          CONTENT=$(base64 -w 0 "$FILE")
+          SHA=$(gh api "repos/${{ github.repository }}/contents/${FILE}?ref=${{ github.head_ref }}" --jq '.sha')
+          gh api "repos/${{ github.repository }}/contents/${FILE}" \
+            -X PUT \
+            -f message="chore: auto-generate hotfix template entries" \
+            -f content="$CONTENT" \
+            -f branch="${{ github.head_ref }}" \
+            -f sha="$SHA"


The commit-via-API step can fail with a 409/sha mismatch if multiple runs update the PR branch around the same time (e.g., rapid pushes triggering synchronize, plus a labeled run). Consider adding a concurrency group keyed by PR (and cancel-in-progress: true) and/or adding a small retry that refetches the latest file SHA before the PUT to make the workflow resilient to concurrent runs.

Copilot · 2026-03-20T23:18:36Z

.github/workflows/hotfix-generate.yml

@@ -0,0 +1,89 @@
+name: Hotfix Template Update
+# This workflow is for temporary use and will deprecate once we move to the


The header comment says the workflow "will deprecate"; grammatically this should be "will be deprecated" (or "will be removed") to avoid ambiguity about whether the workflow deprecates something else or is itself being deprecated.

Suggested change

# This workflow is for temporary use and will deprecate once we move to the

# This workflow is for temporary use and will be deprecated once we move to the

feat: add hotfix auto-tagging and template generation workflows

8308d33

Copilot AI review requested due to automatic review settings March 19, 2026 20:57

Devinwong temporarily deployed to test March 19, 2026 20:57 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong March 19, 2026 20:59 View session

update

d4bcb9a

Devinwong temporarily deployed to test March 19, 2026 20:59 — with GitHub Actions Inactive

Devinwong added the hotfix Only use this label when you are hot fixing an official release label Mar 19, 2026

Copilot AI reviewed Mar 19, 2026

View reviewed changes

.github/workflows/hotfix-generate.yml Outdated Show resolved Hide resolved

.github/workflows/hotfix-autotag.yml Outdated Show resolved Hide resolved

.github/workflows/hotfix-autotag.yml Outdated Show resolved Hide resolved

.github/workflows/hotfix-generate.yml Outdated Show resolved Hide resolved

update

7dde32e

Devinwong temporarily deployed to test March 19, 2026 21:08 — with GitHub Actions Inactive

fix: update hotfix workflows to ensure proper tag creation and templa…

e57452a

…te generation

Copilot AI review requested due to automatic review settings March 19, 2026 21:16

Devinwong temporarily deployed to test March 19, 2026 21:16 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong March 19, 2026 21:18 View session

Copilot AI reviewed Mar 19, 2026

View reviewed changes

feat: implement hotfix injection script for write_files entries in no…

b4c5614

…decustomdata.yml

Devinwong temporarily deployed to test March 19, 2026 21:37 — with GitHub Actions Inactive

fix: enhance hotfix generation script to include additional cloud ini…

9f9a7fc

…tialization scripts

Copilot AI review requested due to automatic review settings March 19, 2026 21:46

Devinwong temporarily deployed to test March 19, 2026 21:46 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong March 19, 2026 21:48 View session

Devinwong removed the hotfix Only use this label when you are hot fixing an official release label Mar 19, 2026

Copilot AI reviewed Mar 19, 2026

View reviewed changes

.github/workflows/hotfix-autotag.yml Outdated Show resolved Hide resolved

.github/workflows/hotfix-generate.yml Show resolved Hide resolved

fix: ensure correct reference is used in checkout step of hotfix auto…

d82c6d7

…-tag workflow

Devinwong temporarily deployed to test March 19, 2026 22:07 — with GitHub Actions Inactive

Devinwong marked this pull request as ready for review March 19, 2026 22:19

Copilot AI review requested due to automatic review settings March 19, 2026 22:19

Devinwong requested review from cameronmeissner, ganeshkumarashok and lilypan26 as code owners March 19, 2026 22:19

Copilot AI review requested due to automatic review settings March 20, 2026 19:18

Devinwong temporarily deployed to test March 20, 2026 19:18 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong March 20, 2026 19:19 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

hack/hotfix_generate.py Show resolved Hide resolved

.github/workflows/hotfix-generate.yml Outdated Show resolved Hide resolved

fix: use aks-node-assistant App token for signed commits

e8e5c85

Uses the same GitHub App token pattern as tidy.yaml to produce verified/signed commits that satisfy branch protection rules. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Devinwong temporarily deployed to test March 20, 2026 20:59 — with GitHub Actions Inactive

fix: add setup-go step before make generate

3e91fa3

Uses go-version-file to match the repo's pinned Go version. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 20, 2026 21:07

Devinwong temporarily deployed to test March 20, 2026 21:08 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong March 20, 2026 21:08 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

.github/workflows/hotfix-generate.yml Show resolved Hide resolved

.github/workflows/hotfix-generate.yml Outdated Show resolved Hide resolved

.github/workflows/hotfix-generate.yml Outdated Show resolved Hide resolved

.github/workflows/hotfix-autotag.yml Outdated Show resolved Hide resolved

fix: align action versions and stage manifest.json

82c8e9f

- Upgrade checkout@v4 → @v6 in both hotfix workflows - Upgrade setup-go@v5 → @v6 - Stage manifest.json in commit step (generated by make generate) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Devinwong temporarily deployed to test March 20, 2026 21:15 — with GitHub Actions Inactive

awesomenix approved these changes Mar 20, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 20, 2026 22:29

Devinwong temporarily deployed to test March 20, 2026 22:29 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong March 20, 2026 22:30 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

.github/workflows/hotfix-generate.yml Outdated Show resolved Hide resolved

fix: streamline hotfix generation by simplifying commit logic and imp…

2f8cd12

…roving script output

Devinwong temporarily deployed to test March 20, 2026 22:49 — with GitHub Actions Inactive

fix: remove hotfix auto-tag workflow for now.

52bfeb5

Copilot AI review requested due to automatic review settings March 20, 2026 23:11

Devinwong temporarily deployed to test March 20, 2026 23:11 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong March 20, 2026 23:12 View session

awesomenix approved these changes Mar 20, 2026

View reviewed changes

Devinwong merged commit f453cb6 into main Mar 20, 2026
22 checks passed

Devinwong deleted the devinwon/hotfix_absvc_customdata branch March 20, 2026 23:17

Copilot AI reviewed Mar 20, 2026

View reviewed changes

Devinwong mentioned this pull request Mar 20, 2026

test: verify hotfix-generate GH Action on official/v20260320 #8147

Open

		@@ -0,0 +1,89 @@
		name: Hotfix Template Update
		# This workflow is for temporary use and will deprecate once we move to the

Conversation

Devinwong commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Devinwong commented Mar 19, 2026 •

edited

Loading