RDKB-66032 : Add auto cherry-pick and gatekeeper workflow callers by bunnam988 · Pull Request #101 · rdkcentral/advanced-security

bunnam988 · 2026-08-07T06:30:42Z

Adds two workflow callers that integrate with the shared engine in rdkcentral/build_tools_workflows (PR #70).

auto-backport.yml — triggers on PR merge when labeled cherry-pick to <branch>:

Calls shared cherry-pick engine which auto-creates a backport PR to the target branch
Handles conflicts, missing branches, and already-applied cases with PR comments
Requires CROSS_REPO_TOKEN secret for cross-repo cascade (topic labels)

gatekeeper.yml — triggers on PR open/sync/review:

develop: informational only, non-blocking
release/support: strict — blocks merge if any companion PR is unapproved or missing cherry-pick
Scoped to develop, release/, support/ branches only

Reason for change: Enable automated backporting and cross-repo review enforcement
Test Procedure: Verified on bunnam988 fork — cherry-pick engine creates PRs, posts conflict/error comments; gatekeeper passes on develop
Risks: Low
Priority: P1

github-actions · 2026-08-07T06:30:54Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

Copilot

Pull request overview

Adds two GitHub Actions workflow callers to integrate this repository with shared automation in rdkcentral/build_tools_workflows, enabling automatic backport PR creation (via cherry-pick labels) and enforcing topic/companion-PR review rules (“gatekeeper”) on selected base branches.

Changes:

Introduces auto-backport.yml to invoke the shared cherry-pick/backport workflow after merge when a cherry-pick to <branch> label is present.
Introduces gatekeeper.yml to invoke the shared gatekeeper workflow on PR activity and review submissions for develop, release/**, and support/**.
Passes CROSS_REPO_TOKEN into the shared workflows for cross-repo behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`.github/workflows/auto-backport.yml`	New workflow caller that triggers shared cherry-pick/backport automation based on PR labels and merge state.
`.github/workflows/gatekeeper.yml`	New workflow caller that triggers shared gatekeeper enforcement on PR events and review submissions for specific base branches.

Suppressed comments (3)

.github/workflows/auto-backport.yml:13

pull_request closed events don't include github.event.label, so trigger_label: ${{ github.event.label.name }} resolves to null/empty. If the reusable workflow expects a non-null string, this can break backport creation on merge events. Default this input to an empty string when no label payload exists.

      trigger_label: ${{ github.event.label.name }}

.github/workflows/auto-backport.yml:10

The reusable workflow is referenced from a mutable branch ref (@develop). For supply-chain safety and reproducibility, pin reusable workflows to an immutable tag or commit SHA (e.g., a versioned release), similar to how other workflows pin build_tools_workflows (see .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14).

    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop

.github/workflows/gatekeeper.yml:21

The reusable workflow is referenced from a mutable branch ref (@develop). For supply-chain safety and reproducibility, pin reusable workflows to an immutable tag or commit SHA (e.g., a versioned release), similar to how other workflows pin build_tools_workflows (see .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14).

    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- auto-backport.yml: triggers cherry-pick engine on PR merge with 'cherry-pick to <branch>' label - gatekeeper.yml: enforces cross-repo review sync before merge on develop, release, and support branches

…igger

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/auto-backport.yml:22

trigger_label is read from github.event.label.name, but the workflow runs for pull_request events only when action == closed (merged PR). The label payload is only present for labeled actions, so this will resolve to null/empty for the merged-PR path and may break the called cherry-pick workflow if it relies on trigger_label to choose the target branch. Consider only populating it for issues/labeled events and otherwise passing an empty string (and relying on raw_labels in the called workflow).

      raw_labels: ${{ github.event_name == 'issues' && toJSON(github.event.issue.labels) || toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event.label.name }}
      pr_number_override: ${{ github.event_name == 'issues' && github.event.issue.number || '' }}

.github/workflows/auto-backport.yml:17

For issues events, github.event.issue.pull_request.url != '' can evaluate true even when the issue is not a PR (the pull_request field is null, and null != ''), which would incorrectly run the cherry-pick workflow on regular issues that happen to have a cherry-pick to … label. Check for a non-null pull_request object instead.

This issue also appears on line 20 of the same file.

      (github.event_name == 'issues' &&
       github.event.issue.pull_request.url != '' &&
       contains(toJSON(github.event.issue.labels.*.name), 'cherry-pick to '))

…herry-picks issues:labeled does not fire for pull requests in GitHub Actions (only for issues). workflow_dispatch lets users manually trigger cherry-pick from Actions tab for any already-merged PR by entering the PR number and target branch.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/gatekeeper.yml:22

This reusable-workflow call is pinned to the moving develop branch. For supply-chain safety and reproducibility, prefer pinning to an immutable ref (a release tag or commit SHA) so workflow behavior can’t change unexpectedly.

        startsWith(github.event.pull_request.base.ref, 'support/')))
    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop
    secrets:

.github/workflows/auto-backport.yml:25

This reusable-workflow call is pinned to the moving develop branch. For supply-chain safety and reproducibility, prefer pinning to an immutable ref (a release tag or commit SHA) so workflow behavior can’t change unexpectedly.

      github.event_name == 'workflow_dispatch'
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop
    with:

.github/workflows/gatekeeper.yml:12

This workflow calls an external reusable workflow but doesn’t set explicit permissions:. In this repo, other reusable-workflow callers (e.g. .github/workflows/pr-lint.yml:7-10 and fossid_integration_stateless_diffscan_target_repo.yml:7-10) declare permissions to ensure the called workflow has the rights it needs and to avoid relying on repository defaults. Consider adding an explicit permissions block here matching the shared gatekeeper workflow’s needs.

This issue also appears on line 20 of the same file.

name: Topic Gatekeeper

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - develop
      - 'release/**'
      - 'support/**'
  pull_request_review:
    types: [submitted]

.github/workflows/auto-backport.yml:16

This workflow calls an external reusable workflow but doesn’t set explicit permissions:. In this repo, other reusable-workflow callers (e.g. .github/workflows/pr-lint.yml:7-10 and fossid_integration_stateless_diffscan_target_repo.yml:7-10) declare permissions to ensure the called workflow has the rights it needs and to avoid relying on repository defaults. Consider adding an explicit permissions block here matching the shared cherry-pick workflow’s needs.

This issue also appears on line 23 of the same file.

name: Automated Cherry-Pick Engine

on:
  pull_request:
    types: [labeled, closed]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'Already-merged PR number to cherry-pick'
        required: true
        type: string
      target_branch:
        description: 'Target branch to cherry-pick to (e.g. support/stable2)'
        required: true
        type: string

.github/workflows/auto-backport.yml:27

trigger_label references github.event.label.name, but that field is only present for the pull_request labeled action. When this job runs on pull_request closed (merged) events, github.event.label is absent, so trigger_label will resolve to null/empty and may not match what the shared workflow expects. Guard the access so it’s only used for the labeled action (and fall back otherwise).

      trigger_label: ${{ github.event_name == 'workflow_dispatch' && format('cherry-pick to {0}', inputs.target_branch) || github.event.label.name }}

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/auto-backport.yml:13

github.event.label.name is only present for the pull_request labeled action, but this workflow also runs on closed. When the job runs on merge (closed + merged == true), trigger_label will be empty/undefined, which can break the shared workflow if it expects the triggering label name.

      trigger_label: ${{ github.event.label.name }}

.github/workflows/auto-backport.yml:10

This workflow is executing a reusable workflow from another repository pinned to the moving develop branch while also providing CROSS_REPO_TOKEN. Pinning to a version tag or commit SHA reduces supply-chain risk and makes runs reproducible (e.g., .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14 pins to @1.0.0).

    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop

.github/workflows/gatekeeper.yml:21

This workflow is executing a reusable workflow from another repository pinned to the moving develop branch while also providing CROSS_REPO_TOKEN. Pinning to a version tag or commit SHA reduces supply-chain risk and makes runs reproducible (e.g., .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:14 pins to @1.0.0).

    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop

.github/workflows/auto-backport.yml:7

This workflow calls a reusable workflow but does not declare permissions, so it will rely on the repository/org default token permissions. The shared cherry-pick workflow typically needs write scopes (create commits/branches, open PRs, post comments); without explicit permissions the job can fail in repos configured with restricted defaults.

This issue also appears in the following locations of the same file:

line 10
line 13

jobs:

.github/workflows/gatekeeper.yml:13

This reusable-workflow caller does not declare permissions, so it will rely on repository/org defaults. Other reusable workflow callers in this repo set explicit permissions (e.g., .github/workflows/pr-lint.yml:7-10), and without them the shared gatekeeper may not be able to comment/update PR state in repos with restricted defaults.

This issue also appears on line 21 of the same file.

jobs:

pull_request:labeled only fires for OPEN PRs, not merged ones. workflow_dispatch lets users manually trigger from Actions tab: enter PR number + target branch to cherry-pick any past merged PR.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/gatekeeper.yml:6

The workflow won’t rerun when a required cherry-pick to <branch> label is added/removed, which can leave the Gatekeeper check stale (e.g., failing due to “missing cherry-pick” even after adding the label). Consider including labeled/unlabeled in the pull_request trigger types so the shared gatekeeper is re-evaluated on label changes.

  pull_request:
    types: [opened, synchronize, reopened]
    branches:

.github/workflows/gatekeeper.yml:11

If an approval is later dismissed, the gatekeeper status may not be recalculated because pull_request_review only listens to submitted. Adding dismissed helps prevent a previously-passing check from remaining green after approvals are removed.

  pull_request_review:
    types: [submitted]

.github/workflows/auto-backport.yml:28

This workflow triggers on pull_request.closed (merge) as well as pull_request.labeled, but github.event.label.name is only populated for the labeled action. On merged/closed events this input will be empty, which can break the shared workflow if it expects trigger_label to be set. Consider explicitly only using github.event.label.name for the labeled action (and otherwise pass an empty string so the callee can rely on raw_labels).

      raw_labels: ${{ github.event_name == 'workflow_dispatch' && format('[{{"name":"cherry-pick to {0}"}}]', inputs.target_branch) || toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event_name == 'workflow_dispatch' && format('cherry-pick to {0}', inputs.target_branch) || github.event.label.name }}
      pr_number_override: ${{ github.event_name == 'workflow_dispatch' && inputs.pr_number || '' }}

.github/workflows/gatekeeper.yml:14

This caller doesn’t declare permissions, so the called reusable workflow will be constrained to the default (typically read-only) GITHUB_TOKEN permissions for pull_request/pull_request_review events. If the shared gatekeeper posts PR comments or sets checks/statuses, it may fail or be unable to report results. Consider explicitly granting the minimal permissions needed (similar to .github/workflows/pr-lint.yml).

jobs:
  run-shared-gatekeeper:

.github/workflows/auto-backport.yml:17

This caller doesn’t declare permissions, so the reusable cherry-pick workflow will be limited to the default GITHUB_TOKEN permissions for pull_request events. If the shared engine creates branches/PRs or posts comments using GITHUB_TOKEN, it may fail without explicit contents: write / pull-requests: write permissions.

on:
  pull_request:
    types: [labeled, closed]
  workflow_dispatch:

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (7)

.github/workflows/auto-backport.yml:24

For pull_request events with action closed (merged), the payload does not include github.event.label, so trigger_label will evaluate to empty. If the shared cherry-pick workflow relies on trigger_label to determine the target branch, merges where the label was applied before merging may not backport correctly. Consider only using github.event.label.name when the action is labeled, and otherwise pass an empty value (and ensure the shared workflow derives the branch from raw_labels for non-labeled events).

      raw_labels: ${{ github.event_name == 'workflow_dispatch' && format('[{{"name":"cherry-pick to {0}"}}]', inputs.target_branch) || toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event_name == 'workflow_dispatch' && format('cherry-pick to {0}', inputs.target_branch) || github.event.label.name }}
      pr_number_override: ${{ github.event_name == 'workflow_dispatch' && inputs.pr_number || '' }}

.github/workflows/gatekeeper.yml:12

No explicit permissions are set for this workflow. Since this calls a reusable workflow, the callee cannot request more GITHUB_TOKEN permissions than the caller provides; if the shared gatekeeper workflow needs to post PR comments or set a status/check, it may fail under restrictive default token permissions. Add an explicit minimal permissions: block aligned to the shared workflow's needs.

name: Topic Gatekeeper

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - develop
      - 'release/**'
      - 'support/**'
  pull_request_review:
    types: [submitted]

.github/workflows/auto-backport.yml:21

The reusable workflow is referenced by a moving branch (@develop). This is a supply-chain/reproducibility risk (the behavior of this workflow can change without changes in this repo). Prefer pinning to a tag or a commit SHA once the shared workflow version is ready.

    if: (github.event.pull_request.merged == true && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')) || github.event_name == 'workflow_dispatch'
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop
    with:

.github/workflows/gatekeeper.yml:22

The reusable workflow is referenced by a moving branch (@develop). This makes runs non-reproducible and increases supply-chain risk. Prefer pinning to a tag or a commit SHA once the shared gatekeeper workflow is versioned.

        startsWith(github.event.pull_request.base.ref, 'support/')))
    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop
    secrets:

.github/workflows/auto-backport.yml:6

No explicit permissions are set for this workflow. For reusable workflows, the called workflow cannot elevate GITHUB_TOKEN permissions beyond what the caller grants, and org/repo defaults can be restrictive; this can cause unexpected failures when the shared cherry-pick workflow needs to comment on PRs or push branches. Define an explicit minimal permissions: block at the top of the workflow to match what the shared workflow requires.

name: Automated Cherry-Pick Engine

on:
  pull_request:
    types: [labeled, closed]
  workflow_dispatch:

.github/workflows/auto-backport.yml:20

This workflow passes CROSS_REPO_TOKEN, but it runs on pull_request events. For PRs coming from forks, GitHub does not provide repository secrets, so the called reusable workflow will likely fail (or run without the token) and can create a failing required check. If fork PRs are expected, gate execution on !github.event.pull_request.head.repo.fork (while still allowing workflow_dispatch).

This issue also appears in the following locations of the same file:

line 19
line 22

  cherry-pick:
    if: (github.event.pull_request.merged == true && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')) || github.event_name == 'workflow_dispatch'
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop

.github/workflows/gatekeeper.yml:20

This job passes CROSS_REPO_TOKEN but runs on pull_request / pull_request_review events. For PRs from forks, repository secrets are not available, so the reusable workflow may fail and produce a failing check. If fork PRs are possible, gate this job with !github.event.pull_request.head.repo.fork (similar to .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:13).

This issue also appears on line 20 of the same file.

    if: |
      github.event_name == 'pull_request' ||
      (github.event_name == 'pull_request_review' &&
       (github.event.pull_request.base.ref == 'develop' ||
        startsWith(github.event.pull_request.base.ref, 'release/') ||

…trigger only)

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/auto-backport.yml:13

github.event.label.name is only present for the pull_request labeled action. This workflow’s job only runs when pull_request.merged == true (typically on the closed action), where github.event.label is not included in the payload, so trigger_label will be empty/null and can break the called reusable workflow if it expects a real label value.

    if: github.event.pull_request.merged == true && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop
    with:
      raw_labels: ${{ toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event.label.name }}

bunnam988 requested a review from a team as a code owner August 7, 2026 06:30

Copilot AI review requested due to automatic review settings August 7, 2026 06:30

bunnam988 requested a review from a team as a code owner August 7, 2026 06:30

Copilot started reviewing on behalf of bunnam988 August 7, 2026 06:31 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Comment thread .github/workflows/auto-backport.yml

Comment thread .github/workflows/gatekeeper.yml

Add auto cherry-pick and gatekeeper workflow callers

265cc90

- auto-backport.yml: triggers cherry-pick engine on PR merge with 'cherry-pick to <branch>' label - gatekeeper.yml: enforces cross-repo review sync before merge on develop, release, and support branches

bunnam988 force-pushed the feature/add-cherry-pick-gatekeeper-callers branch from ef8d18f to 265cc90 Compare August 7, 2026 06:53

Support cherry-pick label on already-merged PRs via issues:labeled tr…

68e60d7

…igger

Copilot AI review requested due to automatic review settings August 7, 2026 08:14

Copilot started reviewing on behalf of bunnam988 August 7, 2026 08:15 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 7, 2026 08:57

Copilot started reviewing on behalf of bunnam988 August 7, 2026 08:58 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Revert to simple pull_request trigger — labeled fires for merged PRs too

2026ed5

Copilot AI review requested due to automatic review settings August 7, 2026 09:08

Copilot started reviewing on behalf of bunnam988 August 7, 2026 09:08 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Add workflow_dispatch trigger for cherry-picking already-merged PRs

21ff4f0

pull_request:labeled only fires for OPEN PRs, not merged ones. workflow_dispatch lets users manually trigger from Actions tab: enter PR number + target branch to cherry-pick any past merged PR.

Copilot AI review requested due to automatic review settings August 7, 2026 09:19

Copilot started reviewing on behalf of bunnam988 August 7, 2026 09:20 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Fix: use single-line if to match working fork pattern exactly

759b0c3

Copilot AI review requested due to automatic review settings August 7, 2026 09:42

Copilot started reviewing on behalf of bunnam988 August 7, 2026 09:43 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Simplify auto-backport: use exact working fork pattern (pull_request …

5ec7f78

…trigger only)

Copilot AI review requested due to automatic review settings August 7, 2026 10:06

Copilot started reviewing on behalf of bunnam988 August 7, 2026 10:07 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

RDKB-66032 : Add auto cherry-pick and gatekeeper workflow callers - #101

RDKB-66032 : Add auto cherry-pick and gatekeeper workflow callers#101
bunnam988 wants to merge 7 commits into
rdkcentral:developfrom
bunnam988:feature/add-cherry-pick-gatekeeper-callers

bunnam988 commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

bunnam988 commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 7, 2026 •

edited

Loading