infra: code freeze workflow

[ajberdy]

Issue #, if available:

Description of changes:

Support for selectively freezing main branch

Testing done:

Manual testing of the following cases:

• Freeze without specifying feature branch:
  • Feature branch can be merged
  • Critical fix can be merged
  • Other code cannot be merged
• Freeze with specifying feature branch:
  • Matching feature branch can be merged (exact and prefix match)
  • Other feature branch cannot be merged
• Freeze off
  • Any code can be merged (check is skipped)

Merge Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your pull request.

General

• I have read the CONTRIBUTING doc
• I used the commit message format described in CONTRIBUTING
• I have updated any necessary documentation, including READMEs and API docs (if appropriate)

Tests

• I have added tests that prove my fix is effective or that my feature works (if appropriate)
• I have checked that my tests are not configured for a specific region or account (if appropriate)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (44a2bbb) 100.00% compared to head (23c8ad4) 100.00%.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #767   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          129       129           
  Lines         8374      8374           
  Branches      1866      1866           
=========================================
  Hits          8374      8374           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[AbeCoull]

Does this make use of action variables? https://github.com/amazon-braket/amazon-braket-sdk-python/settings/variables/actions

[ajberdy]

No these are just set within the workflow. Is there a benefit to moving to action variables until we want to reuse these values?

[ajberdy]

I don't mind the workflow for updating action variables, but there's a limitation that you can't set an empty value (for allowing all feature branch merges) and there's no documentation to attach to the place they get updated.

We could update this workflow to use a more generable/intuitive env variable UNFROZEN_PREFIX to allow us to specify feature or feature/my-feature and not rely on an empty value

[ajberdy]

Updated to use repository variables

[AbeCoull]

For code freezes, will we need to publish PRs each time? If so, I think using the action variables would allow for easier changes and cleaner commit history.

[ajberdy]

Makes sense, I've update the script to use action variables

[AbeCoull]

If the branch is frozen will updates from main break?

[ajberdy]

If the branch is frozen will updates from main break?

There are two settings:

• FROZEN: true/false
• UNFROZEN_PREFIX: str

This workflow will run for any PR into main with the following logic:

FROZEN: bool
UNFROZEN_PREFIX: str

def can_merge_into_main(pr):
    if not FROZEN:
        return True
    else:
        if pr.branch.startswith(UNFROZEN_PREFIX):
            return True
        elif pr.title.startswith("fix:") and pr.title.contains("[critical]"):
            return True
        else:
            return False

I'm not sure specifically what you're asking about, but there is a race condition if the workflow succeeds before the repo is frozen and then is merged after. We can probably fix this by enabling a merge queue (which runs the workflows before merging), but maybe there's a more direct way to trigger this workflow only when the env variable is updated

[ajberdy]

It seems like a benefit of using variables within the file is if we update the workflow on main, then any PRs will have to update their branch (and rerun the code freeze workflow) before merging, avoiding the race condition we get with repository variables. I think that's enough of a reason to at least move the FROZEN variable to the file. We can leave the unfrozen prefix in the action variables if you think it makes sense, or might as well have them together