Create Keycloak nordix fork releases with version-specific backports and security fixes. Use when creating new nordix branches (e.g., 26.2.14-nordix), cherry-picking backports from previous nordix versions, backporting patches like CVEs, managing merge conflicts in cherry-picks, and version tagging nordix releases.
This skill handles the complete workflow for creating and maintaining nordix fork release branches of Keycloak, including backporting features, security fixes, and managing version control.
Nordix maintains forked branches for specific Keycloak versions with strategic backports:
26.2.14)26.2.14-nordix)26.2.14-nordix-1, 26.2.14-nordix-2)Check that repository is ready with both remotes configured
git remote -v
[email protected]:Nordix/keycloak.githttps://github.com/keycloak/keycloak.gitEnsure working directory is clean and on a safe branch
git status
git checkout main
Fetch latest branches and tags from both remotes
git fetch nordix --tags --force
git fetch origin --tags --force
Identify versions - ALWAYS execute this step first, before asking user for input
git tag -l | grep "^{version}$"git tag -l | grep "^{version}-nordix-"echo "=== Upstream releases (latest 15) ===" && git tag -l --sort=-creatordate | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | head -15 && echo -e "\n=== Nordix releases (latest 15) ===" && git tag -l --sort=-creatordate | grep -E '^[0-9]+\.[0-9]+\.[0-9]+-nordix-[0-9]+$' | head -15
Available candidates for new nordix fork:
1) {latest-version-in-series-1} (latest in {series-1}, no nordix release yet)
2) {latest-version-in-series-2} (latest in {series-2}, no nordix release yet)
...
Select version number (1-N) or provide custom version:
Compare versions - Check what changed between base versions and identify backports needed from previous nordix
echo "=== Changes between {old-base} and {new-base} ===" && git --no-pager log {old-base}..{new-base} --oneline && echo -e "\n=== Backports in {old-nordix} (from {old-base}) ===" && git --no-pager log {old-base}..{old-nordix} --oneline
Check if any are already in the new base release
Summarize findings
git checkout -b {version}-nordix {version}
git --no-pager log --oneline -3 # Verify
git cherry-pick <commit1> <commit2> <commit3> ...
git log output is in reverse chronological order (newest first), so reverse the list from git log output when cherry-pickingThis phase applies to any explicit backport request: a CVE/security fix, a commit hash given directly, or any other targeted patch.
Locate the commit to backport
Method 1: Search GitHub advisories by CVE ID
gh api "advisories?cve_id={CVE-XXXX-XXXXX}"
If results are returned, extract the commit ID from the advisory data.
Method 2: Search commit messages for CVE ID
git --no-pager log --all --oneline --grep="CVE-XXXX-XXXXX" origin/main
Method 3: Search upstream release notes
gh release view {upstream-version} --repo keycloak/keycloak
Look for security fixes mentioned in the release notes, then search for related commits.
Method 4: Search by description derived from CVE details
git --no-pager log --all --oneline --grep="keyword-from-cve-description" origin/main
Review the commit before applying
git show <commit-id>
Apply the commit
git cherry-pick <commit-id>
git cherry-pick --continuegit tag {version}-nordix-1
git --no-pager log {base-version}..{version}-nordix --oneline | wc -l
git --no-pager log {version}-nordix --graph --oneline -20
gh release view {previous-nordix-tag} --repo Nordix/keycloakgit push nordix {version}-nordix
git push nordix {version}-nordix-{patch}
Before finalizing a nordix branch, verify:
{version}-nordix-{patch}git checkout -b 26.2.14-nordix 26.2.14
git cherry-pick commit1 commit2 commit3
git tag 26.2.14-nordix-1
Try automatic merge strategies first
git cherry-pick -X ort <commit>
For manual conflict resolution (when automatic strategies fail)
Continue cherry-pick after resolving conflicts
git add <resolved-files>
git rm <deleted-files> # For delete/modify conflicts, remove the file if it was deleted in HEAD
git cherry-pick --continue --no-edit
Summarize conflict resolutions