From 9063ee5fb7f0913f22e25aec0bfab7503be6eafe Mon Sep 17 00:00:00 2001
From: Chlins Zhang <chlins.zhang@gmail.com>
Date: Fri, 31 Jul 2026 00:24:51 +0800
Subject: [PATCH] Replace rebase action with GitHub CLI (#10093)

* Replace rebase action with GitHub CLI

Signed-off-by: chlins <chlins.zhang@gmail.com>

* Add contents write permission for rebase workflow

Updating the PR branch pushes to the head branch, which requires contents: write for the GITHUB_TOKEN.

Signed-off-by: chlins <chlins.zhang@gmail.com>

---------

Signed-off-by: chlins <chlins.zhang@gmail.com>
---
 .github/workflows/rebase.yml       | 36 +++++++++++++++++++++---------
 changelogs/unreleased/10093-chlins |  1 +
 2 files changed, 26 insertions(+), 11 deletions(-)
 create mode 100644 changelogs/unreleased/10093-chlins

diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml
index 064bef70a..6db2503f0 100644
--- a/.github/workflows/rebase.yml
+++ b/.github/workflows/rebase.yml
@@ -1,18 +1,32 @@
-on: 
+name: Automatic Rebase
+
+on:
   issue_comment:
     types: [created]
-name: Automatic Rebase
+
+permissions: {}
+
 jobs:
   rebase:
     name: Rebase
-    if: github.repository == 'velero-io/velero' && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase')
+    if: >-
+      github.repository == 'velero-io/velero' &&
+      github.event.issue.pull_request != null &&
+      github.event.comment.body == '/rebase' &&
+      contains(
+        fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'),
+        github.event.comment.author_association
+      )
     runs-on: ubuntu-latest
+    permissions:
+      # contents: write is required because updating the pull request branch
+      # pushes commits to the head branch.
+      contents: write
+      pull-requests: write
     steps:
-    - name: Checkout the latest code
-      uses: actions/checkout@v6
-      with:
-        fetch-depth: 0
-    - name: Automatic Rebase
-      uses: cirrus-actions/rebase@1.8
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Rebase pull request
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+        run: gh pr update-branch "$PR_NUMBER" --repo "$GH_REPO" --rebase
diff --git a/changelogs/unreleased/10093-chlins b/changelogs/unreleased/10093-chlins
new file mode 100644
index 000000000..143c6b856
--- /dev/null
+++ b/changelogs/unreleased/10093-chlins
@@ -0,0 +1 @@
+Replace rebase action with GitHub CLI