Fix: add explicit permissions so cherry-pick works without CROSS_REPO_TOKEN

[bunnam988]

Root cause of all cherry-pick failures in rdkcentral: GITHUB_TOKEN defaults to read-only. Adds permissions block to both jobs.

Reason for change: GITHUB_TOKEN read-only by default; git push/gh pr create/gh pr comment all fail with 403
Test Procedure: merge a PR, add cherry-pick label → backport PR auto-created
Risks: Low
Priority: P0

[Copilot]

Pull request overview

This PR aims to make the reusable “gatekeeper” and “cherry-pick” GitHub Actions workflows function without requiring CROSS_REPO_TOKEN, by explicitly granting the GITHUB_TOKEN the permissions needed for PR creation/commenting and branch pushes.

Changes:

• Add explicit permissions for the cherry-pick workflow job to allow pushing branches, creating PRs, and applying labels.
• Add explicit permissions for the gatekeeper workflow job (though currently broader than needed for its read-only behavior).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/gatekeeper.yml	Adds job-level token permissions for the gatekeeper job (currently includes unnecessary write scope).
.github/workflows/cherry-pick.yml	Adds job-level token permissions for backport automation (push branch, create PR, comment/label).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

.github/workflows/gatekeeper.yml:15

• The job only uses gh pr view / gh search prs (read-only). Granting pull-requests: write is unnecessary and increases token privileges; the step summary does not require token permissions. Consider least-privilege permissions here.

    permissions:
      contents: read
      pull-requests: write # post step summary and read PR data

.github/workflows/cherry-pick.yml:205

• This suppresses all errors from gh pr comment, so if commenting fails there will be no log signal. Prefer logging a warning while still preventing the step from failing under bash -e.
  .github/workflows/cherry-pick.yml:216
• This suppresses all errors from gh pr comment, so if commenting fails there will be no log signal. Prefer logging a warning while still preventing the step from failing under bash -e.

              if [ -n "$BACKPORT_LABEL" ]; then

.github/workflows/cherry-pick.yml:179

• This suppresses all errors from gh pr comment, so if commenting fails (e.g., bad URL or permission regression) there will be no log signal. Prefer keeping stderr and logging a warning while still preventing the step from failing under bash -e.

This issue also appears in the following locations of the same file:

• line 205
• line 216

            if ! git fetch origin "$TARGET_BRANCH" 2>/dev/null; then

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/gatekeeper.yml:15

• In a reusable workflow (on: workflow_call), the effective GITHUB_TOKEN permissions are inherited from the calling workflow and cannot be elevated here. Also, this job only reads PR metadata/search results and writes to $GITHUB_STEP_SUMMARY, so pull-requests: write is broader than necessary; pull-requests: read should be sufficient and reduces risk.

    permissions:
      contents: read
      pull-requests: write # post step summary and read PR data

.github/workflows/cherry-pick.yml:31

• Because this is a reusable workflow (on: workflow_call), the called workflow cannot increase GITHUB_TOKEN permissions beyond what the caller grants. If callers rely on the repo/org default (often read-only), this permissions: block may not take effect unless the calling workflow explicitly grants these scopes.

    permissions:
      contents: write      # push cherry-pick branch
      pull-requests: write # create PR and post comments
      issues: write        # add labels to issues/PRs

.github/workflows/cherry-pick.yml:161

• This PR is described as only adding explicit token permissions, but this workflow also changes runtime behavior (adds a step summary, suppresses gh pr comment errors with 2>/dev/null || true, and changes PR creation to capture the created URL). Please update the PR description/title to reflect the additional behavior changes, or split them into a separate PR to keep the permissions fix focused.

          SUMMARY="## 🍒 Cherry-Pick Results\n\n**Source PR:** [#${PR_NUMBER}](${PR_URL}) — ${PR_TITLE}\n\n| Target Branch | Result |\n|---|---|\n"