@node-core/utils 6.2.1 → 6.3.1

package/bin/ncu-ci.js

@@ -119,6 +119,11 @@ const args = yargs(hideBin(process.argv))
                     'If not provided, the command will use the SHA of the last approved commit.',
           type: 'string'
         })
+        .option('check-for-duplicates', {
+          describe: 'When set, NCU will query Jenkins recent builds to ensure ' +
+                    'there is not an existing job for the same commit.',
+          type: 'boolean'
+        })
         .option('owner', {
           default: '',
           describe: 'GitHub repository owner'
@@ -298,7 +303,10 @@ class RunPRJobCommand {
       this.cli.setExitCode(1);
       return;
     }
-    const jobRunner = new RunPRJob(cli, request, owner, repo, prid, this.argv.certifySafe);
+    const { certifySafe, checkForDuplicates } = this.argv;
+    const jobRunner = new RunPRJob(
+      cli, request, owner, repo, prid,
+      certifySafe, checkForDuplicates);
     if (!(await jobRunner.start())) {
       this.cli.setExitCode(1);
       process.exitCode = 1;

package/components/git/land.js

@@ -189,6 +189,7 @@ async function main(state, argv, cli, dir) {
     cli.warn(
       'Failed to detect previous session. ' +
       'please run `git node land --abort`');
+    cli.setErrorCode(1);
     return;
   }
 
@@ -197,17 +198,12 @@ async function main(state, argv, cli, dir) {
       cli.warn(
         'Previous `git node land` session for ' +
         `${session.pullName} in progress.`);
-      cli.log('run `git node land --abort` before starting a new session');
-      return;
+      const response = await cli.prompt('Do you want to abort it?', { defaultAnswer: false });
+      if (!response) throw new Error('Please run `git node land --abort`');
+      await session.abort();
+      session = new LandingSession(cli, req, dir, argv);
     }
-    session = new LandingSession(cli, req, dir, argv);
     const metadata = await getMetadata(session.argv, argv.skipRefs, cli);
-    if (argv.backport) {
-      const split = metadata.metadata.split('\n')[0];
-      if (split === 'PR-URL: ') {
-        cli.error('Commit message is missing PR-URL');
-      }
-    }
     return session.start(metadata);
   } else if (state === APPLY) {
     return session.apply();

package/components/git/security.js

@@ -92,110 +92,93 @@ export function builder(yargs) {
 }
 
 export function handler(argv) {
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+
   if (argv.start) {
-    return startSecurityRelease(argv);
+    return startSecurityRelease(cli, argv);
   }
   if (argv.sync) {
-    return syncSecurityRelease(argv);
+    return syncSecurityRelease(cli, argv);
   }
   if (argv['update-date']) {
-    return updateReleaseDate(argv);
+    return updateReleaseDate(cli, argv);
   }
   if (argv['pre-release']) {
-    return createPreRelease(argv);
+    return createPreRelease(cli, argv);
   }
   if (argv['add-report']) {
-    return addReport(argv);
+    return addReport(cli, argv);
   }
   if (argv['remove-report']) {
-    return removeReport(argv);
+    return removeReport(cli, argv);
   }
   if (argv['notify-pre-release']) {
-    return notifyPreRelease(argv);
+    return notifyPreRelease(cli, argv);
   }
   if (argv['request-cve']) {
-    return requestCVEs(argv);
+    return requestCVEs(cli, argv);
   }
   if (argv['post-release']) {
-    return createPostRelease(argv);
+    return createPostRelease(cli, argv);
   }
   if (argv.cleanup) {
-    return cleanupSecurityRelease(argv);
+    return cleanupSecurityRelease(cli, argv);
   }
   yargsInstance.showHelp();
 }
 
-async function removeReport(argv) {
+async function removeReport(cli, argv) {
   const reportId = argv['remove-report'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const update = new UpdateSecurityRelease(cli);
   return update.removeReport(reportId);
 }
 
-async function addReport(argv) {
+async function addReport(cli, argv) {
   const reportId = argv['add-report'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const update = new UpdateSecurityRelease(cli);
   return update.addReport(reportId);
 }
 
-async function updateReleaseDate(argv) {
+async function updateReleaseDate(cli, argv) {
   const releaseDate = argv['update-date'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const update = new UpdateSecurityRelease(cli);
   return update.updateReleaseDate(releaseDate);
 }
 
-async function createPreRelease(argv) {
+async function createPreRelease(cli, argv) {
   const nodejsOrgFolder = argv['pre-release'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const preRelease = new SecurityBlog(cli);
   return preRelease.createPreRelease(nodejsOrgFolder);
 }
 
-async function requestCVEs() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function requestCVEs(cli) {
   const hackerOneCve = new UpdateSecurityRelease(cli);
   return hackerOneCve.requestCVEs();
 }
 
-async function createPostRelease(argv) {
+async function createPostRelease(cli, argv) {
   const nodejsOrgFolder = argv['post-release'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const blog = new SecurityBlog(cli);
   return blog.createPostRelease(nodejsOrgFolder);
 }
 
-async function startSecurityRelease() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function startSecurityRelease(cli) {
   const release = new PrepareSecurityRelease(cli);
   return release.start();
 }
 
-async function cleanupSecurityRelease() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function cleanupSecurityRelease(cli) {
   const release = new PrepareSecurityRelease(cli);
   return release.cleanup();
 }
 
-async function syncSecurityRelease(argv) {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function syncSecurityRelease(cli) {
   const release = new UpdateSecurityRelease(cli);
   return release.sync();
 }
 
-async function notifyPreRelease() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function notifyPreRelease(cli) {
   const preRelease = new SecurityAnnouncement(cli);
   return preRelease.notifyPreRelease();
 }

package/lib/auth.js

@@ -1,32 +1,28 @@
 import fs from 'node:fs';
 import { ClientRequest } from 'node:http';
 
+// eslint-disable-next-line import/no-unresolved
 import ghauth from 'ghauth';
 
 import { clearCachedConfig, encryptValue, getMergedConfig, getNcurcPath } from './config.js';
 
 export default lazy(auth);
 
-function errorExit(message) {
-  process.stderr.write(`${message}\n`);
-  process.exit(1);
-}
-
 function check(username, token, format = /^[A-Za-z0-9_]+$/) {
   if (typeof username !== 'string') {
-    errorExit(`username must be a string, received ${typeof username}`);
+    throw new Error(`username must be a string, received ${typeof username}`);
   }
   if (!/^[a-zA-Z0-9-]+$/.test(username)) {
-    errorExit(
+    throw new Error(
       'username may only contain alphanumeric characters or hyphens, ' +
       `received ${username}`
     );
   }
   if (typeof token !== 'string') {
-    errorExit(`token must be a string, received ${typeof token}`);
+    throw new Error(`token must be a string, received ${typeof token}`);
   }
   if (!format.test(token)) {
-    errorExit(`token is misformatted: ${token}`);
+    throw new Error(`token is misformatted: ${token}`);
   }
 }
 
@@ -51,7 +47,7 @@ async function tryCreateGitHubToken(githubAuth) {
       noDeviceFlow: true
     });
   } catch (e) {
-    errorExit(`Could not get token: ${e.message}`);
+    throw new Error(`Could not get token: ${e.message}`, { cause: e });
   }
   return credentials;
 }
@@ -93,7 +89,7 @@ async function auth(
     get jenkins() {
       const { username, jenkins_token } = getMergedConfig();
       if (!username || !jenkins_token) {
-        errorExit(
+        throw new Error(
           'Get your Jenkins API token in https://ci.nodejs.org/me/security ' +
           'and run the following command to add it to your ncu config: ' +
           'ncu-config --global set -x jenkins_token'

package/lib/ci/build-types/pr_build.js

@@ -15,9 +15,8 @@ const {
 } = CIFailureParser;
 
 export class PRBuild extends TestBuild {
-  constructor(cli, request, id, skipMoreThan) {
+  constructor(cli, request, id, skipMoreThan, tree = PR_TREE) {
     const path = `job/node-test-pull-request/${id}/`;
-    const tree = PR_TREE;
     super(cli, request, path, tree);
     this.skipMoreThan = skipMoreThan;
     this.commitBuild = null;

package/lib/ci/run_ci.js

@@ -1,6 +1,7 @@
 import { FormData } from 'undici';
 
 import {
+  JobParser,
   CI_DOMAIN,
   CI_TYPES,
   CI_TYPES_KEYS
@@ -8,6 +9,7 @@ import {
 import PRData from '../pr_data.js';
 import { debuglog } from '../verbosity.js';
 import PRChecker from '../pr_checker.js';
+import { PRBuild } from './build-types/pr_build.js';
 
 export const CI_CRUMB_URL = `https://${CI_DOMAIN}/crumbIssuer/api/json`;
 const CI_PR_NAME = CI_TYPES.get(CI_TYPES_KEYS.PR).jobName;
@@ -17,7 +19,7 @@ const CI_V8_NAME = CI_TYPES.get(CI_TYPES_KEYS.V8).jobName;
 export const CI_V8_URL = `https://${CI_DOMAIN}/job/${CI_V8_NAME}/build`;
 
 export class RunPRJob {
-  constructor(cli, request, owner, repo, prid, certifySafe) {
+  constructor(cli, request, owner, repo, prid, certifySafe, checkForDuplicates) {
     this.cli = cli;
     this.request = request;
     this.owner = owner;
@@ -29,6 +31,7 @@ export class RunPRJob {
       Promise.all([this.prData.getReviews(), this.prData.getCommits()]).then(() =>
         (this.certifySafe = new PRChecker(cli, this.prData, request, {}).getApprovedTipOfHead())
       );
+    this.checkForDuplicates = checkForDuplicates;
   }
 
   async getCrumb() {
@@ -70,7 +73,7 @@ export class RunPRJob {
   }
 
   async start() {
-    const { cli, certifySafe } = this;
+    const { cli, request, certifySafe, checkForDuplicates } = this;
 
     if (!(await certifySafe)) {
       cli.error('Refusing to run CI on potentially unsafe PR');
@@ -87,9 +90,25 @@ export class RunPRJob {
     }
     cli.stopSpinner('Jenkins credentials valid');
 
+    if (checkForDuplicates) {
+      await this.prData.getComments();
+      const { jobid, link } = new JobParser(this.prData.comments).parse().get('PR') ?? {};
+      const { actions } = jobid
+        ? (await new PRBuild(cli, request, jobid, undefined, 'actions[parameters[name,value]]')
+            .getBuildData())
+        : {};
+      const { parameters } = actions?.find(a => 'parameters' in a) ?? {};
+      if (parameters?.find(c => c.name === 'COMMIT_SHA_CHECK')?.value === certifySafe) {
+        cli.info('Existing CI run found: ' + link);
+        cli.error('Refusing to start a potentially duplicate CI job. Use the ' +
+          '"Resume build" button in the Jenkins UI, or start a new CI manually.');
+        return false;
+      }
+    }
+
     try {
       cli.startSpinner('Starting PR CI job');
-      const response = await this.request.fetch(CI_PR_URL, {
+      const response = await request.fetch(CI_PR_URL, {
         method: 'POST',
         headers: {
           'Jenkins-Crumb': crumb
@@ -106,10 +125,10 @@ export class RunPRJob {
 
       // check if the job need a v8 build and trigger it
       await this.prData.getPR();
-      const labels = this.prData.pr.labels;
-      if (labels.nodes.map(i => i.name).includes('v8 engine')) {
+      const { labels } = this.prData.pr;
+      if (labels?.nodes.some(i => i.name === 'v8 engine')) {
         cli.startSpinner('Starting V8 CI job');
-        const response = await this.request.fetch(CI_V8_URL, {
+        const response = await request.fetch(CI_V8_URL, {
           method: 'POST',
           headers: {
             'Jenkins-Crumb': crumb

package/lib/landing_session.js

@@ -82,12 +82,38 @@ export default class LandingSession extends Session {
   }
 
   async downloadAndPatch() {
-    const { cli, upstream, prid, expectedCommitShas } = this;
+    const { cli, upstream, prid, expectedCommitShas, crossRepoPR } = this;
+
+    if (crossRepoPR) {
+      const { owner, repo } = this;
+      cli.warn(`The configured remote "${upstream}" does not point to the ` +
+        'Pull Request repository.');
+      const isHeadAMergeCommit = () => {
+        try {
+          return runSync('git', ['rev-parse', 'FETCH_HEAD^2']).trim();
+        } catch {}
+      };
+      do {
+        cli.warn('Fetching commits from a different upstream might require user intervention.');
+
+        cli.info('Run the following command to fetch the commit(s):');
+        cli.info(`git fetch git@github.com:${owner}/${repo}.git refs/pull/${prid}/merge`);
+        const response = await cli.prompt('Should NCU run the command for you?',
+          { defaultAnswer: false });
+        if (response) {
+          cli.startSpinner(`Downloading patch for ${prid}`);
+          await forceRunAsync('git',
+            ['fetch', `git@github.com:${owner}/${repo}.git`, `refs/pull/${prid}/merge`],
+            { ignoreFailure: false });
+        }
+      } while (!isHeadAMergeCommit());
+    } else {
+      cli.startSpinner(`Downloading patch for ${prid}`);
+      await runAsync('git', [
+        'fetch', upstream,
+        `refs/pull/${prid}/merge`]);
+    }
 
-    cli.startSpinner(`Downloading patch for ${prid}`);
-    await runAsync('git', [
-      'fetch', upstream,
-      `refs/pull/${prid}/merge`]);
     // We fetched the commit that would result if we used `git merge`.
     // ^1 and ^2 refer to the PR base and the PR head, respectively.
     const [base, head] = await runAsync('git',
@@ -286,6 +312,12 @@ export default class LandingSession extends Session {
       cli.warn('Not yet ready to amend, run `git node land --abort`');
       return;
     }
+
+    const BACKPORT_RE = /^BACKPORT-PR-URL\s*:\s*(\S+)$/i;
+    const PR_RE = /^PR-URL\s*:\s*(\S+)$/i;
+    const REVIEW_RE = /^Reviewed-By\s*:\s*(\S+)$/i;
+    const CVE_RE = /^CVE-ID\s*:\s*(\S+)$/im;
+
     this.startAmending();
 
     const rev = this.getCurrentRev();
@@ -296,52 +328,40 @@ export default class LandingSession extends Session {
     // git has very specific rules about what is a trailer and what is not.
     // Instead of trying to implement those ourselves, let git parse the
     // original commit message and see if it outputs any trailers.
-    const originalHasTrailers = runSync('git', [
+    const originalTrailers = runSync('git', [
       'interpret-trailers', '--parse', '--no-divider'
     ], {
       input: `${original}\n`
-    }).trim().length !== 0;
+    });
+    const containCVETrailer = CVE_RE.test(originalTrailers);
 
     const metadata = this.metadata.trim().split('\n');
-    const amended = original.split('\n');
-
-    // If the original commit message already contains trailers (such as
-    // "Co-authored-by"), we simply add our own metadata after those. Otherwise,
-    // we have to add an empty line so that git recognizes our own metadata as
-    // trailers in the amended commit message.
-    if (!originalHasTrailers) {
-      amended.push('');
-    }
+    const amended = original.slice(0, -originalTrailers.length).trim().split('\n');
 
-    const BACKPORT_RE = /BACKPORT-PR-URL\s*:\s*(\S+)/i;
-    const PR_RE = /PR-URL\s*:\s*(\S+)/i;
-    const REVIEW_RE = /Reviewed-By\s*:\s*(\S+)/i;
-    const CVE_RE = /CVE-ID\s*:\s*(\S+)/i;
+    // Only keep existing trailers that we won't add ourselves
+    const keptTrailers = originalTrailers.split('\n').filter(line =>
+      !!line &&
+      (!PR_RE.test(line) || this.backport) &&
+      !BACKPORT_RE.test(line) &&
+      !REVIEW_RE.test(line));
+    amended.push('', ...keptTrailers);
 
-    let containCVETrailer = false;
     for (const line of metadata) {
-      if (line.length !== 0 && original.includes(line)) {
-        if (line.match(CVE_RE)) {
-          containCVETrailer = true;
-        }
-        if (originalHasTrailers) {
-          cli.warn(`Found ${line}, skipping..`);
-        } else {
-          cli.error('Git found no trailers in the original commit message, ' +
-                    `but '${line}' is present and should be a trailer.`);
-          process.exit(1);  // make it work with git rebase -x
-        }
-      } else {
-        if (line.match(BACKPORT_RE)) {
-          let prIndex = amended.findIndex(datum => datum.match(PR_RE));
-          if (prIndex === -1) {
-            prIndex = amended.findIndex(datum => datum.match(REVIEW_RE)) - 1;
-          }
-          amended.splice(prIndex + 1, 0, line);
-        } else {
-          amended.push(line);
+      if (keptTrailers.includes(line)) {
+        cli.warn(`Found ${line}, skipping..`);
+        continue;
+      }
+
+      if (BACKPORT_RE.test(line)) {
+        const prIndex =
+          (amended.findIndex(datum => PR_RE.test(datum)) + 1) ||
+          amended.findIndex(datum => REVIEW_RE.test(datum));
+        if (prIndex !== -1) {
+          amended.splice(prIndex, 0, line);
+          continue;
         }
       }
+      amended.push(line);
     }
 
     if (!containCVETrailer && this.includeCVE) {
@@ -472,7 +492,7 @@ export default class LandingSession extends Session {
     }
 
     cli.separator();
-    cli.log('The following commits are ready to be pushed to ' +
+    cli.log('The following commits are landable on ' +
       `${upstream}/${branch}`);
     cli.log(`- ${strayVerbose.join('\n- ')}`);
     cli.separator();
@@ -483,8 +503,15 @@ export default class LandingSession extends Session {
       willBeLanded = `${head}...${willBeLanded}`;
     }
 
+    cli.startSpinner('Removing temporary files');
     this.cleanFiles();
-    cli.log('Temporary files removed.');
+    cli.stopSpinner('Temporary files removed.');
+    if (this.crossRepoPR) {
+      cli.warn(`The configured remote "${upstream}" does not point to the ` +
+          'Pull Request repository.');
+      cli.info(`${willBeLanded} should likely not be pushed to "${upstream}"`);
+      return;
+    }
     cli.log('To finish landing:');
     cli.log('1. Run: ');
     cli.log(`   git push ${upstream} ${branch}`);

package/lib/metadata_gen.js

@@ -31,7 +31,6 @@ export default class MetadataGenerator {
     const parser = new LinkParser(owner, repo, op);
     const fixes = parser.getFixes();
     const refs = parser.getRefs().filter(f => f !== prUrl);
-    const altPrUrl = parser.getAltPrUrl();
 
     const meta = [];
 
@@ -44,17 +43,10 @@ export default class MetadataGenerator {
       meta.push(...refs.map((ref) => `Refs: ${ref}`));
     }
     const backport = this.argv ? this.argv.backport : undefined;
-    if (backport) {
-      meta.unshift(`Backport-PR-URL: ${prUrl}`);
-      meta.unshift(`PR-URL: ${altPrUrl}`);
-    } else {
-      // Reviews are only added here as backports should not contain reviews
-      // for the backport itself in the metadata
-      meta.unshift(`PR-URL: ${prUrl}`);
-      meta.push(
-        ...reviewedBy.map((r) => `Reviewed-By: ${r.reviewer.getContact()}`)
-      );
-    }
+    meta.unshift(`${backport ? 'Backport-' : ''}PR-URL: ${prUrl}`);
+    meta.push(
+      ...reviewedBy.map((r) => `Reviewed-By: ${r.reviewer.getContact()}`)
+    );
     meta.push(''); // creates final EOL
     return meta.join('\n');
   }

package/lib/prepare_release.js

@@ -133,88 +133,12 @@ export default class ReleasePreparation extends Session {
     return true;
   }
 
-  async prepareSecurity() {
-    const {
-      cli,
-      newVersion,
-      versionComponents,
-      releaseBranch,
-      filterLabels
-    } = this;
-
-    // Create new proposal branch.
-    cli.startSpinner(`Switching to proposal branch for ${newVersion}`);
-    const proposalBranch = await this.createProposalBranch(releaseBranch);
-    cli.stopSpinner(`Switched to proposal branch for ${newVersion}`);
-
-    const success = await this.cherryPickSecurityPRs(filterLabels);
-    if (!success) {
-      cli.error('Aborting security release preparation. ' +
-        'Remember to exclude the proposal branch.' +
-        'git branch -D ' + proposalBranch);
-      return;
-    }
-    // Update version and release info in src/node_version.h.
-    cli.startSpinner(`Updating 'src/node_version.h' for ${newVersion}`);
-    await this.updateNodeVersion();
-    cli.stopSpinner(`Updated 'src/node_version.h' for ${newVersion}`);
-
-    // Update any REPLACEME tags in the docs.
-    cli.startSpinner('Updating REPLACEME items in docs');
-    await this.updateREPLACEMEs();
-    cli.stopSpinner('Updated REPLACEME items in docs');
-
-    // Fetch date to use in release commit & changelogs.
-    const todayDate = new Date().toISOString().split('T')[0];
-    this.date = await cli.prompt('Enter release date in YYYY-MM-DD format:',
-      { questionType: 'input', defaultAnswer: todayDate });
-
-    cli.startSpinner('Updating CHANGELOG.md');
-    await this.updateMainChangelog();
-    cli.stopSpinner('Updated CHANGELOG.md');
-
-    cli.startSpinner(`Updating CHANGELOG_V${versionComponents.major}.md`);
-    await this.updateMajorChangelog();
-    cli.stopSpinner(`Updated CHANGELOG_V${versionComponents.major}.md`);
-
-    // Create release commit.
-    const shouldCreateReleaseCommit = await cli.prompt(
-      'Create release commit?');
-    if (!shouldCreateReleaseCommit) {
-      cli.warn(`Aborting \`git node release\` for version ${newVersion}`);
-      return;
-    }
-
-    // Proceed with release only after the releaser has amended
-    // it to their liking.
-    const createDefaultCommit = await this.createReleaseCommit();
-    if (!createDefaultCommit) {
-      const lastCommitSha = runSync('git', ['rev-parse', '--short', 'HEAD']);
-      cli.warn(`Please manually edit commit ${lastCommitSha} by running ` +
-      '`git commit --amend` before proceeding.');
-    }
-
-    cli.separator();
-    cli.ok(`Release preparation for ${newVersion} complete.\n`);
-    cli.info(
-      'To finish the release proposal, run: \n' +
-      `      $ git push -u ${this.upstream} v${newVersion}-proposal\n` +
-      'Finally, proceed to Jenkins and begin the following CI jobs:\n' +
-      '      * https://ci.nodejs.org/job/node-test-pull-request/\n' +
-      '      * https://ci.nodejs.org/job/citgm-smoker/');
-    cli.info(
-      'If this release has deps/v8 changes, you\'ll also need to run:\n' +
-      '      * https://ci.nodejs.org/job/node-test-commit-v8-linux/'
-    );
-  }
-
   async prepare() {
     const { cli, newVersion, versionComponents, isSecurityRelease } = this;
 
     if (isSecurityRelease) {
       this.config.owner = 'nodejs-private';
       this.config.repo = 'node-private';
-      return this.prepareSecurity();
     }
 
     const runBranchDiff = await cli.prompt(
@@ -222,30 +146,38 @@ export default class ReleasePreparation extends Session {
       '(recommended except for Maintenance releases)?',
       { defaultAnswer: this.runBranchDiff });
     if (runBranchDiff) {
-      // TODO: UPDATE re-use
-      // Check the branch diff to determine if the releaser
-      // wants to backport any more commits before proceeding.
-      cli.startSpinner('Fetching branch-diff');
-      const raw = await this.getBranchDiff({
-        onlyNotableChanges: false,
-        comparisonBranch: newVersion
-      });
-
-      const diff = raw.split('*');
-      cli.stopSpinner('Got branch diff');
-
-      const outstandingCommits = diff.length - 1;
-      if (outstandingCommits !== 0) {
-        const proceed = await cli.prompt(
+      if (isSecurityRelease) {
+        const success = await this.cherryPickSecurityPRs(this.filterLabels);
+        if (!success) {
+          cli.error('Aborting security release preparation.');
+          return;
+        }
+      } else {
+        // TODO: UPDATE re-use
+        // Check the branch diff to determine if the releaser
+        // wants to backport any more commits before proceeding.
+        cli.startSpinner('Fetching branch-diff');
+        const raw = await this.getBranchDiff({
+          onlyNotableChanges: false,
+          comparisonBranch: newVersion
+        });
+
+        const diff = raw.split('*');
+        cli.stopSpinner('Got branch diff');
+
+        const outstandingCommits = diff.length - 1;
+        if (outstandingCommits !== 0) {
+          const proceed = await cli.prompt(
           `There are ${outstandingCommits} commits that may be ` +
           `backported to ${this.stagingBranch} - do you still want to proceed?`,
           { defaultAnswer: false });
 
-        if (!proceed) {
-          const seeDiff = await cli.prompt(
-            'Do you want to see the branch diff?');
-          if (seeDiff) cli.log(raw);
-          return;
+          if (!proceed) {
+            const seeDiff = await cli.prompt(
+              'Do you want to see the branch diff?');
+            if (seeDiff) cli.log(raw);
+            return;
+          }
         }
       }
     }