From a81cea72495c6d0ac775222468d88fdc26554941 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sun, 25 Oct 2026 09:57:29 +0100
Subject: [PATCH] tools: avoid rewriting same-version OpenSSL updates

Replay the existing update branch onto the current target branch before
running the updater on scheduled runs. Its version check then skips the
same version without rewriting the PR, preserving approvals and CI.

This also carries contributor commits into a newer update. Manual
dispatches bypass the replay so the update can still be regenerated.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
---
 .github/workflows/update-openssl.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 04c2b9f8a5a..d616a1f30a4 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -26,9 +26,11 @@ jobs:
     env:
       TARGET_BRANCH: ${{ github.ref_name }}
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      PR_BRANCH: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
       - name: Setup Git config
         run: |
@@ -37,6 +39,13 @@ jobs:
           if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then
             echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV"
           fi
+      - name: Apply existing OpenSSL update
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          if git show-ref --verify --quiet "refs/remotes/origin/$PR_BRANCH" &&
+             ! git merge-base --is-ancestor "origin/$PR_BRANCH" HEAD; then
+            git cherry-pick --empty=drop "HEAD..origin/$PR_BRANCH"
+          fi
       - name: Check and download new OpenSSL version
         run: |
           ./tools/dep_updaters/update-openssl.sh download \
@@ -72,6 +81,6 @@ jobs:
           author: Node.js GitHub Bot <github-bot@iojs.org>
           committer: Node.js GitHub Bot <github-bot@iojs.org>
           body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}.
-          branch: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
+          branch: ${{ env.PR_BRANCH }}
           labels: dependencies, openssl
           title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}'