[RajaLucy]

Reason for change: Integrating cherrypick automation workflow files.

Test Procedure: refer ticket.

Risks: Medium

Priority: P2

version: Patch

[Copilot]

🟡 Changes recommended

Rebase merges can lose commits, concurrent runs can be canceled, and target parsing has correctness issues.

4 open findings

• Fixed concurrency group silently drops queued backport jobs · New
• Cherry-picking merge SHA omits commits from rebased PRs · New
• Empty backport_to incorrectly consumes the next PR-body field · New
• Empty backport_to incorrectly consumes unrelated template fields · New

What changed in this PR

Adds automated validation and creation of backport pull requests.

Changes:

• Validates and maps backport_to targets.
• Cherry-picks merged changes onto target branches.
• Creates backport PRs and reports conflicts.

File	Description
.github/​workflows/​pr-validate-release.yml	Validates requested backport targets.
.github/​workflows/​backport.yml	Creates branches and PRs for backports.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Parsing, concurrency, rerun idempotency, and token fallback issues can prevent or duplicate backports.

1 open finding

• Fallback token cannot trigger PR validation workflows · New

4 resolved since last review

• Cherry-picking merge SHA omits commits from rebased PRs
• Fixed concurrency group silently drops queued backport jobs
• Empty backport_to incorrectly consumes unrelated template fields
• Empty backport_to incorrectly consumes the next PR-body field

Previously missed (1)

In code that hasn't changed since last review

Reruns create duplicate backport branches and PRs

.github/​workflows/​backport.yml:306

The workflow is not idempotent on rerun: once a previous attempt pushed feature/<TICKET>, this loop always skips it and selects a new suffix. The later existing-PR lookup checks only that newly selected head, so rerunning a successful or partially successful job can create duplicate branches and PRs. Use a deterministic name including the source PR and target, and resume/exit when its PR already exists.

🧠 Review effort: Balanced