nodejs · aduh95 · Jul 11, 2025 · Jul 10, 2025
diff --git a/lib/cherry_pick.js b/lib/cherry_pick.js
@@ -11,12 +11,16 @@ export default class CherryPick {
  constructor(prid, dir, cli, {
    owner,
    repo,
+    upstream,
+    gpgSign,
    lint,
    includeCVE
  } = {}) {
    this.prid = prid;
    this.cli = cli;
    this.dir = dir;
+    this.upstream = upstream;
+    this.gpgSign = gpgSign;
    this.options = { owner, repo, lint, includeCVE };
  }

@@ -88,14 +92,15 @@ export default class CherryPick {
      } else if (cleanLint === LINT_RESULTS.SUCCESS) {
        cli.ok('Lint passed cleanly');
      }
-      return this.amend(metadata.metadata, commitInfo);
+      this.metadata = metadata.metadata;
+      return this.amend(commitInfo);
    } catch (e) {
      cli.error(e.message);
      return false;
    }
  }

-  async amend(metadata, commitInfo) {
+  async amend(commitInfo) {
    const { cli } = this;
    const subjects = await runAsync('git',
      ['log', '--pretty=format:%s', `${commitInfo.base}..${commitInfo.head}`],
@@ -116,7 +121,7 @@ export default class CherryPick {
      await runAsync('git', ['commit', '--amend', '--no-edit']);
    }

-    return LandingSession.prototype.amend.call(this, metadata);
+    return LandingSession.prototype.amend.call(this);
  }

  readyToAmend() {

diff --git a/lib/landing_session.js b/lib/landing_session.js
@@ -7,6 +7,7 @@ import Session from './session.js';
 import {
  shortSha, isGhAvailable, getEditor
 } from './utils.js';
+import { debuglog, isDebugVerbosity } from './verbosity.js';

 const isWindows = process.platform === 'win32';

@@ -27,9 +28,6 @@ export default class LandingSession extends Session {
    this.lint = lint;
    this.autorebase = autorebase;
    this.fixupAll = fixupAll;
-    this.gpgSign = argv?.['gpg-sign']
-      ? (argv['gpg-sign'] === true ? ['-S'] : ['-S', argv['gpg-sign']])
-      : [];
    this.oneCommitMax = oneCommitMax;
    this.expectedCommitShas = [];
    this.checkCI = !!checkCI;
@@ -120,6 +118,9 @@ export default class LandingSession extends Session {
        ['cherry-pick', '--allow-empty', ...this.gpgSign, `${base}..${head}`],
        { ignoreFailure: false });
    } catch (ex) {
+      if (isDebugVerbosity()) {
+        debuglog('[LandingSession] Got error', ex);
+      }
      cli.error('Failed to apply patches');
      process.exit(1);
    }

diff --git a/lib/prepare_release.js b/lib/prepare_release.js
@@ -70,6 +70,8 @@ export default class ReleasePreparation extends Session {
      const cp = new CherryPick(pr.number, this.dir, cli, {
        owner: this.owner,
        repo: this.repo,
+        gpgSign: this.gpgSign,
+        upstream: this.isSecurityRelease ? `https://${this.username}:${this.config.token}@github.com/${this.owner}/${this.repo}.git` : this.upstream,
        lint: false,
        includeCVE: true
      });

diff --git a/lib/promote_release.js b/lib/promote_release.js
@@ -17,13 +17,10 @@ const dryRunMessage = 'You are running in dry-run mode, meaning NCU will not run

 export default class ReleasePromotion extends Session {
  constructor(argv, req, cli, dir) {
-    super(cli, dir);
+    super(cli, dir, null, argv);
    this.req = req;
    this.dryRun = !argv.run;
    this.proposalUpstreamRemote = argv.fetchFrom ?? this.upstream;
-    this.gpgSign = argv?.['gpg-sign']
-      ? (argv['gpg-sign'] === true ? ['-S'] : ['-S', argv['gpg-sign']])
-      : [];
  }

  get branch() {

diff --git a/lib/session.js b/lib/session.js
@@ -20,6 +20,9 @@ export default class Session {
    this.dir = dir;
    this.prid = prid;
    this.config = { ...getMergedConfig(this.dir), ...argv };
+    this.gpgSign = argv?.['gpg-sign']
+      ? (argv['gpg-sign'] === true ? ['-S'] : ['-S', argv['gpg-sign']])
+      : [];

    if (warnForMissing) {
      const { upstream, owner, repo } = this;

diff --git a/lib/voting_session.js b/lib/voting_session.js
@@ -29,7 +29,6 @@ export default class VotingSession extends Session {
    this.abstain = abstain;
    this.closeVote = argv['decrypt-key-part'];
    this.postComment = argv['post-comment'];
-    this.gpgSign = argv['gpg-sign'];
  }

  get argv() {