backporting: check if the fix is already applied

do this with a tool so it's deterministic, it uses:
> git log --grep=RHEL-012345
or
> git log --grep=CVE-XXXX-XXXX

previously we just asked the agent to figure it out, now we have a
reliable way of checking this

Signed-off-by: Tomas Tomecek <ttomecek@redhat.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Assisted-by: Cursor(Claude)

Author: TomasTomecek

beeai/Makefile

@@ -44,6 +44,7 @@ run-backport-agent-standalone:
 		-e JIRA_ISSUE=$(JIRA_ISSUE) \
 		-e BRANCH=$(BRANCH) \
 		-e DRY_RUN=$(DRY_RUN) \
+		-e CVE_ID=$(CVE_ID) \
 		backport-agent
 
 

beeai/agents/backport_agent.py

@@ -25,7 +25,7 @@
 
 from tools.specfile import AddChangelogEntryTool, BumpReleaseTool
 from tools.text import CreateTool, InsertTool, StrReplaceTool, ViewTool
-from tools.wicked_git import GitPatchCreationTool
+from tools.wicked_git import GitLogSearchTool, GitPatchCreationTool
 from constants import COMMIT_PREFIX, BRANCH_PREFIX
 from observability import setup_observability
 from tools.commands import RunShellCommandTool
@@ -39,6 +39,7 @@ class InputSchema(BaseModel):
     package: str = Field(description="Package to update")
     upstream_fix: str = Field(description="Link to an upstream fix for the issue")
     jira_issue: str = Field(description="Jira issue to reference as resolved")
+    cve_id: str = Field(default="", description="CVE ID if the jira issue is a CVE")
     dist_git_branch: str = Field(description="Git branch in dist-git to be updated")
     git_repo_basepath: str = Field(
         description="Base path for cloned git repos",
@@ -60,6 +61,8 @@ class OutputSchema(BaseModel):
 def render_prompt(input: InputSchema) -> str:
     template = (
         'Work inside the repository cloned at "{{ git_repo_basepath }}/{{ package }}"\n'
+        "Use the `git_log_search` tool to check if the jira issue ({{ jira_issue }}) or CVE ({{ cve_id }}) is already resolved.\n"
+        "If the issue or the cve are already resolved, exit the backporting process with success=True and status=\"Backport already applied\"\n"
         "Download the upstream fix from {{ upstream_fix }}\n"
         'Store the patch file as "{{ jira_issue }}.patch" in the repository root\n'
         "If directory {{ unpacked_sources }} is not a git repository, run `git init` in it "
@@ -83,7 +86,6 @@ def backport_git_steps(data):
             commit_title=f"{COMMIT_PREFIX} backport {input_data.jira_issue}",
             files_to_commit=f"*.spec and {input_data.jira_issue}.patch",
             branch_name=f"{BRANCH_PREFIX}-{input_data.jira_issue}",
-            git_url=input_data.git_url,
             dist_git_branch=input_data.dist_git_branch,
         )
 
@@ -136,6 +138,7 @@ async def main() -> None:
     logging.basicConfig(level=logging.INFO)
 
     setup_observability(os.getenv("COLLECTOR_ENDPOINT"))
+    cve_id = os.getenv("CVE_ID", "")
 
     async with mcp_tools(os.getenv("MCP_GATEWAY_URL")) as gateway_tools:
         agent = RequirementAgent(
@@ -149,6 +152,7 @@ async def main() -> None:
                 InsertTool(),
                 StrReplaceTool(),
                 GitPatchCreationTool(),
+                GitLogSearchTool(),
                 BumpReleaseTool(),
                 AddChangelogEntryTool(),
             ]
@@ -200,6 +204,7 @@ async def run(input):
                 upstream_fix=upstream_fix,
                 jira_issue=jira_issue,
                 dist_git_branch=branch,
+                cve_id=cve_id,
             )
             unpacked_sources, local_clone = prepare_package(package, jira_issue, branch, input)
             input.unpacked_sources = str(unpacked_sources)
@@ -245,6 +250,7 @@ class Task(BaseModel):
                     upstream_fix=backport_data.patch_url,
                     jira_issue=backport_data.jira_issue,
                     dist_git_branch=backport_data.branch,
+                    cve_id=backport_data.cve_id,
                 )
                 input.unpacked_sources, local_clone = prepare_package(
                     backport_data.package, backport_data.jira_issue, backport_data.branch, input

beeai/agents/tests/unit/test_tools.py

@@ -8,7 +8,12 @@
 
 from beeai_framework.middleware.trajectory import GlobalTrajectoryMiddleware
 
-from tools.wicked_git import GitPatchCreationTool, GitPatchCreationToolInput
+from tools.wicked_git import (
+    GitPatchCreationTool,
+    GitPatchCreationToolInput,
+    GitLogSearchTool,
+    GitLogSearchToolInput,
+)
 from tools.commands import RunShellCommandTool, RunShellCommandToolInput
 from tools.specfile import (
     AddChangelogEntryTool,
@@ -306,10 +311,12 @@ def git_repo(tmp_path):
     file_path = repo_path / "file.txt"
     file_path.write_text("Line 1\n")
     subprocess.run(["git", "add", "file.txt"], cwd=repo_path, check=True)
-    subprocess.run(["git", "commit", "-m", "Initial commit"], cwd=repo_path, check=True)
+    subprocess.run(["git", "commit", "-m", "Initial commit\n\nCVE-2025-12345"],
+        cwd=repo_path, check=True)
     file_path.write_text("Line1\nLine 2\n")
     subprocess.run(["git", "add", "file.txt"], cwd=repo_path, check=True)
-    subprocess.run(["git", "commit", "-m", "Initial commit2"], cwd=repo_path, check=True)
+    subprocess.run(["git", "commit", "-m", "Initial commit2\n\nResolves: RHEL-123456"],
+        cwd=repo_path, check=True)
     subprocess.run(["git", "branch", "line-2"], cwd=repo_path, check=True)
     return repo_path
 
@@ -348,3 +355,26 @@ async def test_git_patch_creation_tool_success(git_repo, tmp_path):
     assert output_patch.exists()
     # The patch file should contain the commit message "Add line 3"
     assert "Add line 3" in output_patch.read_text()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "cve_id, jira_issue, expected",
+    [
+        ("CVE-2025-12345", "", "Found 1 matching commit(s) for 'CVE-2025-12345'"),
+        ("CVE-2025-12346", "", "No matches found for 'CVE-2025-12346'"),
+        ("", "RHEL-123456", "Found 1 matching commit(s) for 'RHEL-123456'"),
+        ("", "RHEL-123457", "No matches found for 'RHEL-123457'"),
+    ]
+)
+async def test_git_log_search_tool_found(git_repo, cve_id, jira_issue, expected):
+    tool = GitLogSearchTool()
+    output = await tool.run(
+        input=GitLogSearchToolInput(
+            repository_path=str(git_repo),
+            cve_id=cve_id,
+            jira_issue=jira_issue,
+        )
+    ).middleware(GlobalTrajectoryMiddleware(pretty=True))
+    result = output.result
+    assert expected in result

beeai/agents/tools/wicked_git.py

@@ -91,4 +91,61 @@ async def _run(
             return StringToolOutput(result=f"Successfully created a patch file: {tool_input.patch_file_path}")
         except Exception as e:
             # we absolutely need to do this otherwise the error won't appear anywhere
-            return StringToolOutput(result=f"ERROR: {e}")
+            return StringToolOutput(result=f"ERROR: {e}")
+
+
+class GitLogSearchToolInput(BaseModel):
+    repository_path: str = Field(description="Absolute path to the git repository")
+    cve_id: str = Field(description="CVE ID to look for in git history")
+    jira_issue: str = Field(description="Jira issue to look for in git history")
+
+
+class GitLogSearchTool(Tool[GitLogSearchToolInput, ToolRunOptions, StringToolOutput]):
+    name = "git_log_search"
+    description = """
+    Searches the git history for a reference to either the provided cve_id or jira_issue.
+    Returns the commit hash and the commit message.
+    """
+    input_schema = GitLogSearchToolInput
+
+    def _create_emitter(self) -> Emitter:
+        return Emitter.root().child(
+            namespace=["tool", "git", self.name],
+            creator=self,
+        )
+
+    async def _run(
+        self, tool_input: GitLogSearchToolInput, options: ToolRunOptions | None, context: RunContext
+    ) -> StringToolOutput:
+        repo_path = Path(tool_input.repository_path)
+        if not repo_path.exists():
+            return StringToolOutput(result=f"ERROR: Repository path does not exist: {repo_path}")
+
+        if not (repo_path / ".git").exists():
+            return StringToolOutput(result=f"ERROR: Not a git repository: {repo_path}")
+        search = tool_input.cve_id or tool_input.jira_issue
+        if not search:
+            return StringToolOutput(
+                result="ERROR: No search string provided, jira_issue or cve_id is required")
+
+        cmd = [
+            "git",
+            "log",
+            "--no-merges",
+            f"--grep={search}",
+            "-n", "1",
+            f"--pretty=%s %H",
+        ]
+
+        result = await run_command(cmd, cwd=repo_path)
+        if result["exit_code"] != 0:
+            return StringToolOutput(result=f"ERROR: Git command failed: {result['stderr']}")
+
+        output = (result["stdout"] or "").strip()
+        if not output:
+            return StringToolOutput(result=f"No matches found for '{search}'")
+
+        lines = output.splitlines()
+        header = f"Found {len(lines)} matching commit(s) for '{search}'"
+        # We do not return the output because it could confuse the agent
+        return StringToolOutput(result=header)

beeai/agents/triage_agent.py

@@ -53,6 +53,7 @@ class BackportData(BaseModel):
     patch_url: str = Field(description="URL or reference to the source of the fix")
     justification: str = Field(description="Clear explanation of why this patch fixes the issue")
     jira_issue: str = Field(description="Jira issue identifier")
+    cve_id: str = Field(description="CVE identifier")
 
 
 class ClarificationNeededData(BaseModel):
@@ -212,6 +213,7 @@ def render_prompt(input: InputSchema) -> str:
           PACKAGE: [package name]
           BRANCH: [target branch]
           PATCH_URL: [URL or reference to the source of the fix]
+          CVE_ID: [CVE identifier, leave blank if not applicable]
           JUSTIFICATION: [A brief but clear explanation of why this patch fixes the issue, linking it to the root cause.]
 
       If Clarification Needed: