From 7f062413b65e49e0643da57483c08283d01c06ec Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sun, 25 Oct 2026 09:57:29 +0100
Subject: [PATCH] tools: avoid rewriting same-version OpenSSL updates

Replay the existing update branch onto the current target branch before
running the updater on scheduled runs. Its version check then skips the
same version without rewriting the PR, preserving approvals and CI.

This also carries contributor commits into a newer update. Manual
dispatches bypass the replay so the update can still be regenerated.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
---
 .github/workflows/update-openssl.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 04c2b9f8a5a..6ed32fa1b27 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -13,6 +13,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   openssl-update:
@@ -26,6 +27,7 @@ jobs:
     env:
       TARGET_BRANCH: ${{ github.ref_name }}
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      PR_BRANCH: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -37,6 +39,20 @@ jobs:
           if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then
             echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV"
           fi
+      - name: Apply existing OpenSSL update
+        if: github.event_name != 'workflow_dispatch'
+        shell: bash
+        run: |
+          commit_list=$(gh pr list --repo "$GITHUB_REPOSITORY" \
+            --head "$PR_BRANCH" --base "$TARGET_BRANCH" --state open \
+            --json commits,isCrossRepository \
+            --jq 'first(.[] | select(.isCrossRepository | not)).commits[]?.oid')
+          if [ -n "$commit_list" ]; then
+            git fetch --depth=2 --no-tags origin $commit_list
+            git cherry-pick --empty=drop $commit_list
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Check and download new OpenSSL version
         run: |
           ./tools/dep_updaters/update-openssl.sh download \
@@ -72,6 +88,6 @@ jobs:
           author: Node.js GitHub Bot <github-bot@iojs.org>
           committer: Node.js GitHub Bot <github-bot@iojs.org>
           body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}.
-          branch: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
+          branch: ${{ env.PR_BRANCH }}
           labels: dependencies, openssl
           title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}'