RDKB-66032 : Add auto cherry-pick and gatekeeper workflow callers

[bunnam988]

Adds two workflow callers that integrate with the shared engine in rdkcentral/build_tools_workflows (PR #70).

auto-backport.yml — triggers on PR merge when labeled cherry-pick to <branch>:

• Calls shared cherry-pick engine which auto-creates a backport PR to the target branch
• Handles conflicts, missing branches, and already-applied cases with PR comments
• Requires CROSS_REPO_TOKEN secret for cross-repo cascade (topic labels)

gatekeeper.yml — triggers on PR open/sync/review:

• develop: informational only, non-blocking
• release/support: strict — blocks merge if any companion PR is unapproved or missing cherry-pick
• Scoped to develop, release/, support/ branches only

Reason for change: Enable automated backporting and cross-repo review enforcement
Test Procedure: Verified on bunnam988 fork — cherry-pick engine creates PRs, posts conflict/error comments; gatekeeper passes on develop
Risks: Low
Priority: P1

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Copilot]

Pull request overview

Adds two GitHub Actions workflow callers to integrate this repository with shared automation in rdkcentral/build_tools_workflows, enabling automatic backport PR creation (via cherry-pick labels) and enforcing topic/companion-PR review rules (“gatekeeper”) on selected base branches.

Changes:

• Introduces auto-backport.yml to invoke the shared cherry-pick/backport workflow after merge when a cherry-pick to <branch> label is present.
• Introduces gatekeeper.yml to invoke the shared gatekeeper workflow on PR activity and review submissions for develop, release/**, and support/**.
• Passes CROSS_REPO_TOKEN into the shared workflows for cross-repo behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/auto-backport.yml	New workflow caller that triggers shared cherry-pick/backport automation based on PR labels and merge state.
.github/workflows/gatekeeper.yml	New workflow caller that triggers shared gatekeeper enforcement on PR events and review submissions for specific base branches.

Suppressed comments (3)

.github/workflows/auto-backport.yml:13

• pull_request closed events don't include github.event.label, so trigger_label: ${{ github.event.label.name }} resolves to null/empty. If the reusable workflow expects a non-null string, this can break backport creation on merge events. Default this input to an empty string when no label payload exists.

      trigger_label: ${{ github.event.label.name }}

.github/workflows/auto-backport.yml:10

• The reusable workflow is referenced from a mutable branch ref (@develop). For supply-chain safety and reproducibility, pin reusable workflows to an immutable tag or commit SHA (e.g., a versioned release), similar to how other workflows pin build_tools_workflows (see .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14).

    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop

.github/workflows/gatekeeper.yml:21

• The reusable workflow is referenced from a mutable branch ref (@develop). For supply-chain safety and reproducibility, pin reusable workflows to an immutable tag or commit SHA (e.g., a versioned release), similar to how other workflows pin build_tools_workflows (see .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14).

    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/auto-backport.yml:22

• trigger_label is read from github.event.label.name, but the workflow runs for pull_request events only when action == closed (merged PR). The label payload is only present for labeled actions, so this will resolve to null/empty for the merged-PR path and may break the called cherry-pick workflow if it relies on trigger_label to choose the target branch. Consider only populating it for issues/labeled events and otherwise passing an empty string (and relying on raw_labels in the called workflow).

      raw_labels: ${{ github.event_name == 'issues' && toJSON(github.event.issue.labels) || toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event.label.name }}
      pr_number_override: ${{ github.event_name == 'issues' && github.event.issue.number || '' }}

.github/workflows/auto-backport.yml:17

• For issues events, github.event.issue.pull_request.url != '' can evaluate true even when the issue is not a PR (the pull_request field is null, and null != ''), which would incorrectly run the cherry-pick workflow on regular issues that happen to have a cherry-pick to … label. Check for a non-null pull_request object instead.

This issue also appears on line 20 of the same file.

      (github.event_name == 'issues' &&
       github.event.issue.pull_request.url != '' &&
       contains(toJSON(github.event.issue.labels.*.name), 'cherry-pick to '))

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/gatekeeper.yml:22

• This reusable-workflow call is pinned to the moving develop branch. For supply-chain safety and reproducibility, prefer pinning to an immutable ref (a release tag or commit SHA) so workflow behavior can’t change unexpectedly.

        startsWith(github.event.pull_request.base.ref, 'support/')))
    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop
    secrets:

.github/workflows/auto-backport.yml:25

• This reusable-workflow call is pinned to the moving develop branch. For supply-chain safety and reproducibility, prefer pinning to an immutable ref (a release tag or commit SHA) so workflow behavior can’t change unexpectedly.

      github.event_name == 'workflow_dispatch'
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop
    with:

.github/workflows/gatekeeper.yml:12

• This workflow calls an external reusable workflow but doesn’t set explicit permissions:. In this repo, other reusable-workflow callers (e.g. .github/workflows/pr-lint.yml:7-10 and fossid_integration_stateless_diffscan_target_repo.yml:7-10) declare permissions to ensure the called workflow has the rights it needs and to avoid relying on repository defaults. Consider adding an explicit permissions block here matching the shared gatekeeper workflow’s needs.

This issue also appears on line 20 of the same file.

name: Topic Gatekeeper

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - develop
      - 'release/**'
      - 'support/**'
  pull_request_review:
    types: [submitted]

.github/workflows/auto-backport.yml:16

• This workflow calls an external reusable workflow but doesn’t set explicit permissions:. In this repo, other reusable-workflow callers (e.g. .github/workflows/pr-lint.yml:7-10 and fossid_integration_stateless_diffscan_target_repo.yml:7-10) declare permissions to ensure the called workflow has the rights it needs and to avoid relying on repository defaults. Consider adding an explicit permissions block here matching the shared cherry-pick workflow’s needs.

This issue also appears on line 23 of the same file.

name: Automated Cherry-Pick Engine

on:
  pull_request:
    types: [labeled, closed]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'Already-merged PR number to cherry-pick'
        required: true
        type: string
      target_branch:
        description: 'Target branch to cherry-pick to (e.g. support/stable2)'
        required: true
        type: string

.github/workflows/auto-backport.yml:27

• trigger_label references github.event.label.name, but that field is only present for the pull_request labeled action. When this job runs on pull_request closed (merged) events, github.event.label is absent, so trigger_label will resolve to null/empty and may not match what the shared workflow expects. Guard the access so it’s only used for the labeled action (and fall back otherwise).

      trigger_label: ${{ github.event_name == 'workflow_dispatch' && format('cherry-pick to {0}', inputs.target_branch) || github.event.label.name }}

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/auto-backport.yml:13

• github.event.label.name is only present for the pull_request labeled action, but this workflow also runs on closed. When the job runs on merge (closed + merged == true), trigger_label will be empty/undefined, which can break the shared workflow if it expects the triggering label name.

      trigger_label: ${{ github.event.label.name }}

.github/workflows/auto-backport.yml:10

• This workflow is executing a reusable workflow from another repository pinned to the moving develop branch while also providing CROSS_REPO_TOKEN. Pinning to a version tag or commit SHA reduces supply-chain risk and makes runs reproducible (e.g., .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14 pins to @1.0.0).

    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop

.github/workflows/gatekeeper.yml:21

• This workflow is executing a reusable workflow from another repository pinned to the moving develop branch while also providing CROSS_REPO_TOKEN. Pinning to a version tag or commit SHA reduces supply-chain risk and makes runs reproducible (e.g., .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14 pins to @1.0.0).

    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop

.github/workflows/auto-backport.yml:7

• This workflow calls a reusable workflow but does not declare permissions, so it will rely on the repository/org default token permissions. The shared cherry-pick workflow typically needs write scopes (create commits/branches, open PRs, post comments); without explicit permissions the job can fail in repos configured with restricted defaults.

This issue also appears in the following locations of the same file:

• line 10
• line 13

jobs:

.github/workflows/gatekeeper.yml:13

• This reusable-workflow caller does not declare permissions, so it will rely on repository/org defaults. Other reusable workflow callers in this repo set explicit permissions (e.g., .github/workflows/pr-lint.yml:7-10), and without them the shared gatekeeper may not be able to comment/update PR state in repos with restricted defaults.

This issue also appears on line 21 of the same file.

jobs:

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/gatekeeper.yml:6

• The workflow won’t rerun when a required cherry-pick to <branch> label is added/removed, which can leave the Gatekeeper check stale (e.g., failing due to “missing cherry-pick” even after adding the label). Consider including labeled/unlabeled in the pull_request trigger types so the shared gatekeeper is re-evaluated on label changes.

  pull_request:
    types: [opened, synchronize, reopened]
    branches:

.github/workflows/gatekeeper.yml:11

• If an approval is later dismissed, the gatekeeper status may not be recalculated because pull_request_review only listens to submitted. Adding dismissed helps prevent a previously-passing check from remaining green after approvals are removed.

  pull_request_review:
    types: [submitted]

.github/workflows/auto-backport.yml:28

• This workflow triggers on pull_request.closed (merge) as well as pull_request.labeled, but github.event.label.name is only populated for the labeled action. On merged/closed events this input will be empty, which can break the shared workflow if it expects trigger_label to be set. Consider explicitly only using github.event.label.name for the labeled action (and otherwise pass an empty string so the callee can rely on raw_labels).

      raw_labels: ${{ github.event_name == 'workflow_dispatch' && format('[{{"name":"cherry-pick to {0}"}}]', inputs.target_branch) || toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event_name == 'workflow_dispatch' && format('cherry-pick to {0}', inputs.target_branch) || github.event.label.name }}
      pr_number_override: ${{ github.event_name == 'workflow_dispatch' && inputs.pr_number || '' }}

.github/workflows/gatekeeper.yml:14

• This caller doesn’t declare permissions, so the called reusable workflow will be constrained to the default (typically read-only) GITHUB_TOKEN permissions for pull_request/pull_request_review events. If the shared gatekeeper posts PR comments or sets checks/statuses, it may fail or be unable to report results. Consider explicitly granting the minimal permissions needed (similar to .github/workflows/pr-lint.yml).

jobs:
  run-shared-gatekeeper:

.github/workflows/auto-backport.yml:17

• This caller doesn’t declare permissions, so the reusable cherry-pick workflow will be limited to the default GITHUB_TOKEN permissions for pull_request events. If the shared engine creates branches/PRs or posts comments using GITHUB_TOKEN, it may fail without explicit contents: write / pull-requests: write permissions.

on:
  pull_request:
    types: [labeled, closed]
  workflow_dispatch: