openstack-backport — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openstack-backport (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill analyzes commits on the master branch of an OpenStack repository to identify which commits should be backported to maintained stable branches according to OpenStack backport policy.
Fetch the series status from OpenStack releases repository:
https://opendev.org/openstack/releases/raw/branch/master/data/series_status.yamlParse this YAML to identify branches with status maintained or extended maintenance. These are the target branches for backports.
Example status values:
development - Current development branch (master)maintained - Actively maintained stable branchextended maintenance - Extended supportunmaintained - No longer supportedend of life - EOLOnly consider branches with maintained or extended maintenance status as backport targets.
Support flexible commit range specification:
By count: "check last 10 commits"
git log -n 10 --onelineSince release/tag: "check commits since 2024.1"
git log <tag>..HEAD --onelineSince date: "check commits since 2024-01-01"
git log --since="2024-01-01" --onelineBetween tags: "check commits between 2024.1 and 2024.2"
git log <tag1>..<tag2> --onelineUnreleased commits: "check unreleased commits"
# Get latest tag
latest_tag=$(git describe --tags --abbrev=0)
git log ${latest_tag}..HEAD --onelineIf the user doesn't specify a range, default to unreleased commits since the last tag.
For each commit, extract bug references from the commit message. OpenStack uses these formats:
Closes-Bug: #1234567 - This commit completely fixes the bugPartial-Bug: #1234567 - This commit partially addresses the bugRelated-Bug: #1234567 - This commit is related to the bugAlso check for:
Closes-Bug: https://bugs.launchpad.net/project/+bug/1234567Use regex patterns to extract bug IDs:
Closes-Bug:\s*#?(\d+)
Partial-Bug:\s*#?(\d+)
Related-Bug:\s*#?(\d+)
Closes-Bug:.*bugs\.launchpad\.net/.*/\+bug/(\d+)For each bug ID found, query the Launchpad API to get bug priority:
https://api.launchpad.net/1.0/bugs/{bug_id}The response is JSON. Extract the importance field:
{
"importance": "High",
"title": "Bug title",
"status": "Fix Committed",
...
}Possible importance values:
CriticalHighMediumLowWishlistUndecidedBackport qualification: Only Critical and High bugs qualify for backport.
Handle errors gracefully:
For each maintained branch, check if the commit has already been backported:
git branch -r | grep "origin/stable/"For each stable branch:
git log origin/stable/<branch> --grep="<commit-sha>" --all-matchOr check if the commit exists in the branch:
git branch -r --contains <commit-sha>Also look for cherry-pick references in commit messages on stable branches that reference the original commit SHA.
Structure the output in two views:
#### View 1: By Commit
List each commit that qualifies for backport, showing:
#### View 2: By Branch
Group commits by target stable branch, showing:
Include summary statistics:
Use this template:
# OpenStack Backport Analysis
**Repository**: <repo-name>
**Analysis Date**: <date>
**Commit Range**: <range-description>
## Summary
- Total commits analyzed: X
- Backport candidates: Y
- Maintained stable branches: Z
- Critical bugs: A
- High bugs: B
---
## Maintained Branches
| Branch | Status | Commits Needed |
|--------|--------|----------------|
| stable/2024.1 | maintained | 5 |
| stable/2023.2 | extended maintenance | 3 |
---
## Backport Candidates (By Commit)
### Commit: abc1234 - Fix critical memory leak in scheduler
- **Date**: 2024-04-15
- **Author**: Jane Developer
- **Bug**: [LP#1234567](https://bugs.launchpad.net/project/+bug/1234567) - **Priority: Critical**
- **Target Branches**: stable/2024.1, stable/2023.2
- **Already Backported**: No
- **Cherry-pick**:git cherry-pick abc1234
### Commit: def5678 - Fix high priority race condition
- **Date**: 2024-04-10
- **Author**: John Maintainer
- **Bug**: [LP#2345678](https://bugs.launchpad.net/project/+bug/2345678) - **Priority: High**
- **Target Branches**: stable/2024.1
- **Already Backported**: stable/2023.2
- **Cherry-pick**:git cherry-pick def5678
---
## Backport Plan (By Branch)
### stable/2024.1 (5 commits needed)
git checkout stable/2024.1 git cherry-pick abc1234 git cherry-pick def5678 git cherry-pick ghi9012 git cherry-pick jkl3456 git cherry-pick mno7890
**Commits**:
1. abc1234 - Fix critical memory leak (Critical)
2. def5678 - Fix race condition (High)
3. ghi9012 - Fix database deadlock (Critical)
4. jkl3456 - Fix API timeout (High)
5. mno7890 - Fix config parsing (High)
### stable/2023.2 (3 commits needed)
git checkout stable/2023.2 git cherry-pick abc1234 git cherry-pick ghi9012 git cherry-pick mno7890
**Commits**:
1. abc1234 - Fix critical memory leak (Critical)
2. ghi9012 - Fix database deadlock (Critical)
3. mno7890 - Fix config parsing (High)
---
## Excluded Commits
### Medium/Low Priority (X commits)
- pqr1234 - LP#3456789 (Medium): Fix minor logging issue
- stu5678 - LP#4567890 (Low): Improve error message
### No Bug Reference (Y commits)
- vwx9012 - Refactor utility function (no bug reference)
### Features (Z commits)
- yza3456 - Add new API endpoint (feature, not eligible)
---
## Notes
- All backport candidates have been verified against Launchpad
- Commits already backported to some branches are noted
- Use `git log <branch>` to verify before cherry-picking
- Test each cherry-pick in a local environment before proposingHandle common errors gracefully:
Example 1: Check last 20 commits
User: check the last 20 commits for backport candidatesExample 2: Check since a specific release
User: what needs backporting to stable branches since 2024.1?Example 3: Check specific date range
User: find backport candidates from the last monthExample 4: Target specific branch
User: show me what commits should go to stable/2024.1In all cases:
The report should be comprehensive but scannable - use tables, clear headings, and actionable commands so maintainers can quickly act on the findings.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.