RDKB-66032 : Add auto cherry-pick and gatekeeper workflow callers

[bunnam988]

Adds two workflow callers that integrate with the shared engine in rdkcentral/build_tools_workflows (PR #70).

auto-backport.yml — triggers on PR merge when labeled cherry-pick to <branch>:

• Calls shared cherry-pick engine which auto-creates a backport PR to the target branch
• Handles conflicts, missing branches, and already-applied cases with PR comments
• Requires CROSS_REPO_TOKEN secret for cross-repo cascade (topic labels)

gatekeeper.yml — triggers on PR open/sync/review:

• develop: informational only, non-blocking
• release/support: strict — blocks merge if any companion PR is unapproved or missing cherry-pick
• Scoped to develop, release/, support/ branches only

Reason for change: Enable automated backporting and cross-repo review enforcement
Test Procedure: Verified on bunnam988 fork — cherry-pick engine creates PRs, posts conflict/error comments; gatekeeper passes on develop
Risks: Low
Priority: P1

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Copilot]

Pull request overview

Adds two GitHub Actions “workflow caller” entries to this repo to integrate with the shared automation in rdkcentral/build_tools_workflows: one for auto cherry-picking/backport PR creation and one for “topic gatekeeper” review enforcement.

Changes:

• Add auto-backport.yml to invoke the shared cherry-pick/backport engine after merge when a cherry-pick to <branch> label is present.
• Add gatekeeper.yml to invoke the shared gatekeeper workflow on PR activity and review submission for develop/release/support branch targets.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/gatekeeper.yml	Adds a reusable-workflow caller for the shared gatekeeper on PR and review events.
.github/workflows/auto-backport.yml	Adds a reusable-workflow caller for the shared cherry-pick/backport engine on PR events.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/gatekeeper.yml:4

• This workflow caller doesn’t declare explicit permissions. Because reusable workflows inherit the caller’s GITHUB_TOKEN permissions, gatekeeper may be unable to set commit statuses/checks or post PR comments depending on the repo/org default. Add an explicit permissions block appropriate for the shared gatekeeper workflow.

name: Topic Gatekeeper

on:
  pull_request:

.github/workflows/auto-backport.yml:13

• pull_request event includes both labeled and closed, but the current if will also run on any label added after merge as long as the PR has a cherry-pick to ... label somewhere. That can retrigger the cherry-pick engine and create duplicate backport PR attempts. Also, github.event.label.name is undefined for the closed action, so trigger_label will be empty/invalid on merge events.

  cherry-pick:
    if: github.event.pull_request.merged == true && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop
    with:
      raw_labels: ${{ toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event.label.name }}

.github/workflows/auto-backport.yml:5

• This workflow caller doesn’t declare explicit permissions. Reusable workflows inherit the caller’s token permissions, so behavior can vary (or fail) depending on the repo/org default permissions. Since the cherry-pick engine needs to create branches/PRs and post PR comments, explicitly grant the required write scopes here.

name: Automated Cherry-Pick Engine

on:
  pull_request:
    types: [labeled, closed]

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

.github/workflows/gatekeeper.yml:3

• This workflow calls a reusable workflow in rdkcentral/build_tools_workflows but does not declare explicit GITHUB_TOKEN permissions. In this repo, other reusable-workflow callers (e.g., .github/workflows/pr-lint.yml:7-10) set permissions explicitly; without them, the shared gatekeeper may fail to comment/update PRs depending on the repo's default token permissions. Define minimal required permissions here.

name: Topic Gatekeeper

on:

.github/workflows/auto-backport.yml:22

• github.event.label.name is only present for .../labeled events; when this workflow runs on pull_request closed (merge) events, github.event.label is undefined and trigger_label will be empty/invalid. Set trigger_label conditionally so merged/closed runs don't pass a missing value.

      raw_labels: ${{ github.event_name == 'issues' && toJSON(github.event.issue.labels) || toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event.label.name }}
      pr_number_override: ${{ github.event_name == 'issues' && github.event.issue.number || '' }}

.github/workflows/auto-backport.yml:3

• This workflow calls a reusable workflow in rdkcentral/build_tools_workflows but does not declare explicit GITHUB_TOKEN permissions. In this repo, other reusable-workflow callers (e.g., .github/workflows/pr-lint.yml:7-10) set permissions explicitly; without them, the shared cherry-pick engine may fail to create branches/PRs or post comments depending on the repo's default token permissions. Define minimal required permissions here.

name: Automated Cherry-Pick Engine

on:

.github/workflows/auto-backport.yml:17

• github.event.issue.pull_request.url != '' does not reliably gate this job to PR-backed issues: for a regular issue the pull_request field is null, and the expression can still evaluate truthy, so labeling a normal issue with a cherry-pick to ... label could incorrectly trigger the cherry-pick engine. Check for a non-null pull_request object instead.

      (github.event_name == 'issues' &&
       github.event.issue.pull_request.url != '' &&
       contains(toJSON(github.event.issue.labels.*.name), 'cherry-pick to '))

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/auto-backport.yml:28

• trigger_label falls back to github.event.label.name, but for the pull_request closed action there is no github.event.label payload. That can result in a null/empty value being passed to the reusable workflow (or an expression evaluation error depending on how the called workflow consumes it). Handle the non-labeled pull_request actions explicitly and pass an empty string (the called workflow can still infer from raw_labels).

      raw_labels: ${{ github.event_name == 'workflow_dispatch' && format('[{{"name":"cherry-pick to {0}"}}]', inputs.target_branch) || toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event_name == 'workflow_dispatch' && format('cherry-pick to {0}', inputs.target_branch) || github.event.label.name }}
      pr_number_override: ${{ github.event_name == 'workflow_dispatch' && inputs.pr_number || '' }}

.github/workflows/auto-backport.yml:24

• This workflow calls a reusable workflow pinned to the moving develop branch. For supply-chain safety and reproducibility, prefer pinning reusable workflows to a tag or commit SHA so behavior can’t change unexpectedly without updating this repo.

    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop

.github/workflows/gatekeeper.yml:13

• This workflow doesn’t declare permissions: for GITHUB_TOKEN. Other workflows in this repo explicitly set least-privilege permissions (e.g. .github/workflows/pr-lint.yml:7-10, .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:7-10). Without an explicit block, token permissions depend on the repository/org default and can break posting status/comments or other GitHub API calls from the reusable workflow. Add an explicit permissions:` block aligned with what the reusable workflow needs.

  pull_request_review:
    types: [submitted]

jobs:

.github/workflows/auto-backport.yml:24

• This workflow doesn’t declare permissions: for GITHUB_TOKEN. Other workflows in this repo explicitly set least-privilege permissions (e.g. .github/workflows/pr-lint.yml:7-10, .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:7-10). Without an explicit block, this job’s token permissions depend on the repository/org default and may be too restrictive for creating backport branches/PRs or posting PR comments. Add an explicit permissions:` block aligned with what the reusable workflow needs.

jobs:
  cherry-pick:
    if: |
      (github.event_name == 'pull_request' &&
       github.event.pull_request.merged == true &&
       contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')) ||
      github.event_name == 'workflow_dispatch'
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop

.github/workflows/gatekeeper.yml:21

• This workflow calls a reusable workflow pinned to the moving develop branch. For supply-chain safety and reproducibility, prefer pinning reusable workflows to a tag or commit SHA so behavior can’t change unexpectedly without updating this repo.

    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

.github/workflows/auto-backport.yml:15

• github.event.label.name is only present for the pull_request labeled event. When this workflow runs on pull_request closed (merge), that context will be null, which can break the shared reusable workflow input handling. Also, this workflow will run for fork PRs where CROSS_REPO_TOKEN is not available, causing avoidable failures/noise.

  cherry-pick:
    if: github.event.pull_request.merged == true && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop
    with:
      raw_labels: ${{ toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event.label.name }}
    secrets:
      CROSS_REPO_TOKEN: ${{ secrets.CROSS_REPO_TOKEN }}

.github/workflows/gatekeeper.yml:20

• This workflow will also trigger for fork PR activity (especially pull_request_review), but secrets like CROSS_REPO_TOKEN are not provided to fork-based pull_request workflows. Add a fork guard so the job is skipped for forks to avoid failing/noisy runs.

  run-shared-gatekeeper:
    if: |
      github.event_name == 'pull_request' ||
      (github.event_name == 'pull_request_review' &&
       (github.event.pull_request.base.ref == 'develop' ||
        startsWith(github.event.pull_request.base.ref, 'release/') ||
        startsWith(github.event.pull_request.base.ref, 'support/')))

.github/workflows/auto-backport.yml:7

• Other workflows in this repo declare explicit permissions (e.g., .github/workflows/pr-lint.yml and .github/workflows/cla.yml). Without an explicit permissions block here, the reusable cherry-pick workflow may run with insufficient default GITHUB_TOKEN permissions depending on repo/org settings (commonly read-only), preventing branch/PR creation or commenting.

This issue also appears on line 8 of the same file.

name: Automated Cherry-Pick Engine

on:
  pull_request:
    types: [labeled, closed]

jobs:

.github/workflows/gatekeeper.yml:13

• This workflow calls a reusable workflow and passes CROSS_REPO_TOKEN, but (like the other workflows in this repo) it should declare explicit permissions so the called workflow has predictable GITHUB_TOKEN capabilities. Relying on repository/org defaults can cause the gatekeeper to be unable to comment or set checks/statuses.

This issue also appears on line 14 of the same file.

name: Topic Gatekeeper

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - develop
      - 'release/**'
      - 'support/**'
  pull_request_review:
    types: [submitted]

jobs:

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

.github/workflows/auto-backport.yml:23

• For PRs originating from forks, repository secrets (including CROSS_REPO_TOKEN) are not provided to pull_request-triggered workflows. This job will likely run with an empty token and fail/no-op; consider skipping fork PRs (or switching to pull_request_target with appropriate hardening).

    if: |
      (github.event_name == 'pull_request' &&
       github.event.pull_request.merged == true &&
       contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')) ||
      github.event_name == 'workflow_dispatch'

.github/workflows/gatekeeper.yml:11

• If an approval is dismissed, this workflow will not re-run, so the gatekeeper check can remain in a stale "passing" state even though the PR is no longer approved. Include the dismissed review event type so the check status stays accurate.

    types: [submitted]

.github/workflows/gatekeeper.yml:20

• This workflow unconditionally passes CROSS_REPO_TOKEN into the reusable workflow. On pull_request / pull_request_review events from forks, secrets are not exposed, so the downstream workflow will likely fail and could block merges if the check is required. Consider skipping fork PRs (or switching to pull_request_target with appropriate hardening).

      github.event_name == 'pull_request' ||
      (github.event_name == 'pull_request_review' &&
       (github.event.pull_request.base.ref == 'develop' ||
        startsWith(github.event.pull_request.base.ref, 'release/') ||
        startsWith(github.event.pull_request.base.ref, 'support/')))

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/auto-backport.yml:23

• trigger_label falls back to github.event.label.name, but the workflow also runs on pull_request closed events (merge). The closed event payload does not include github.event.label, so this input will be empty/undefined and can break the reusable cherry-pick workflow if it expects a non-empty trigger label. Gate this value on github.event.action == 'labeled', and otherwise pass an empty string (or derive from raw_labels).

      trigger_label: ${{ github.event_name == 'workflow_dispatch' && format('cherry-pick to {0}', inputs.target_branch) || github.event.label.name }}

.github/workflows/gatekeeper.yml:6

• This workflow calls a reusable workflow but doesn't declare explicit permissions. In this repo, other reusable-workflow callers set permissions (e.g. .github/workflows/pr-lint.yml:7-10, .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:7-10). Consider adding a permissions: block that matches the shared gatekeeper workflow’s needs so it doesn’t depend on repo/org defaults.

name: Topic Gatekeeper

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:

.github/workflows/auto-backport.yml:6

• This workflow calls a reusable workflow and passes CROSS_REPO_TOKEN, but it doesn't declare explicit permissions. If the repo/org default GITHUB_TOKEN permissions are set to read-only (common in orgs), the reusable workflow may fail when trying to create branches/PRs or post PR comments/statuses. Add an explicit permissions: block that matches the shared cherry-pick workflow's documented requirements (at minimum likely contents: write and pull-requests: write).

name: Automated Cherry-Pick Engine

on:
  pull_request:
    types: [labeled, closed]
  workflow_dispatch:

.github/workflows/auto-backport.yml:21

• The reusable workflow is referenced via @develop, which is mutable. Since this workflow forwards CROSS_REPO_TOKEN, pinning the reusable workflow to a tagged release or a commit SHA would reduce the risk of unexpected behavior changes (or compromised upstream) affecting this repo.

    if: (github.event.pull_request.merged == true && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')) || github.event_name == 'workflow_dispatch'
    uses: rdkcentral/build_tools_workflows/.github/workflows/cherry-pick.yml@develop
    with:

.github/workflows/gatekeeper.yml:21

• The reusable workflow is referenced via @develop, which is mutable. For a policy-enforcement workflow like gatekeeper, pinning to a tagged release or commit SHA helps ensure deterministic behavior across time and reduces supply-chain risk.

    uses: rdkcentral/build_tools_workflows/.github/workflows/gatekeeper.yml@develop

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

.github/workflows/auto-backport.yml:13

• trigger_label is sourced from github.event.label.name, but this workflow only actually runs when the PR is merged (the closed action). In that event payload, github.event.label is not present, so this input will be null/empty and can break the called reusable workflow if it expects a value. Since raw_labels already contains all labels, consider dropping trigger_label (or computing it from pull_request.labels).

    with:
      raw_labels: ${{ toJSON(github.event.pull_request.labels) }}
      trigger_label: ${{ github.event.label.name }}

.github/workflows/gatekeeper.yml:20

• This workflow passes CROSS_REPO_TOKEN, but pull_request workflows do not receive secrets for PRs opened from forks. If a forked PR targets develop/release/support, this job will fail at runtime due to the missing secret. Consider skipping fork PRs here (as done in .github/workflows/fossid_integration_stateless_diffscan_target_repo.yml:13) or switching to a pull_request_target-based approach if it's safe for the called workflow.

    if: |
      github.event_name == 'pull_request' ||
      (github.event_name == 'pull_request_review' &&
       (github.event.pull_request.base.ref == 'develop' ||
        startsWith(github.event.pull_request.base.ref, 'release/') ||

.github/workflows/auto-backport.yml:9

• This workflow passes CROSS_REPO_TOKEN, but pull_request workflows do not receive secrets for PRs opened from forks. If a forked PR is merged with a cherry-pick label, this job will fail due to the missing secret. Consider skipping fork PRs here (or using a pull_request_target-based approach if safe for the called workflow).

    if: github.event.pull_request.merged == true && contains(toJSON(github.event.pull_request.labels.*.name), 'cherry-pick to ')

.github/workflows/auto-backport.yml:4

• This reusable-workflow caller does not declare permissions. If the shared cherry-pick workflow uses GITHUB_TOKEN to create branches/PRs or comment, it may fail when the repo default token permissions are read-only. Consider adding an explicit permissions block (likely needs contents: write and pull-requests: write).

name: Automated Cherry-Pick Engine

on:
  pull_request:

.github/workflows/gatekeeper.yml:4

• This reusable-workflow caller does not declare permissions. Other callers in this repo (e.g. .github/workflows/pr-lint.yml) set explicit permissions to ensure the called workflow can comment/update PRs even when the repo default GITHUB_TOKEN permissions are read-only. Consider adding an explicit permissions block here (at minimum pull-requests: write if the shared gatekeeper posts PR comments).

name: Topic Gatekeeper

on:
  pull_request: