Commit 95f3cf072e8 for nodejs

commit 95f3cf072e83d94ac90616c86a370b250f44a8d7
Author: Filip Skokan <panva.ip@gmail.com>
Date:   Sun Nov 1 10:16:06 2026 +0100

    tools: avoid rewriting same-version OpenSSL updates

    Replay the existing update branch onto the current target branch before
    running the updater on scheduled runs. Its version check then skips the
    same version without rewriting the PR, preserving approvals and CI.

    This also carries contributor commits into a newer update. Manual
    dispatches bypass the replay so the update can still be regenerated.

    Signed-off-by: Filip Skokan <panva.ip@gmail.com>
    Assisted-by: Codex
    PR-URL: https://github.com/nodejs/node/pull/66999
    Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 04c2b9f8a5a..6ed32fa1b27 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -13,6 +13,7 @@ on:

 permissions:
   contents: read
+  pull-requests: read

 jobs:
   openssl-update:
@@ -26,6 +27,7 @@ jobs:
     env:
       TARGET_BRANCH: ${{ github.ref_name }}
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      PR_BRANCH: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -37,6 +39,20 @@ jobs:
           if [ "$TARGET_BRANCH" != "$DEFAULT_BRANCH" ]; then
             echo "PR_TITLE_PREFIX=[${TARGET_BRANCH%-staging}] " >> "$GITHUB_ENV"
           fi
+      - name: Apply existing OpenSSL update
+        if: github.event_name != 'workflow_dispatch'
+        shell: bash
+        run: |
+          commit_list=$(gh pr list --repo "$GITHUB_REPOSITORY" \
+            --head "$PR_BRANCH" --base "$TARGET_BRANCH" --state open \
+            --json commits,isCrossRepository \
+            --jq 'first(.[] | select(.isCrossRepository | not)).commits[]?.oid')
+          if [ -n "$commit_list" ]; then
+            git fetch --depth=2 --no-tags origin $commit_list
+            git cherry-pick --empty=drop $commit_list
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Check and download new OpenSSL version
         run: |
           ./tools/dep_updaters/update-openssl.sh download \
@@ -72,6 +88,6 @@ jobs:
           author: Node.js GitHub Bot <github-bot@iojs.org>
           committer: Node.js GitHub Bot <github-bot@iojs.org>
           body: This is an automated update of OpenSSL to ${{ env.NEW_VERSION }} for ${{ github.ref_name }}.
-          branch: actions/${{ github.ref_name != github.event.repository.default_branch && format('{0}/', github.ref_name) || '' }}tools-update-openssl
+          branch: ${{ env.PR_BRANCH }}
           labels: dependencies, openssl
           title: '${{ env.PR_TITLE_PREFIX }}deps: update OpenSSL to ${{ env.NEW_VERSION }}'