[RajaLucy]

Reason for change: Integrating cherrypick automation workflow files.

Test Procedure: refer ticket.

Risks: Medium

Priority: P2

version: Patch

[Copilot]

🟡 Changes recommended

Concurrency, rerun idempotency, parsing, and workflow-token security issues can cause missed or duplicate backports.

6 open findings

• Untrusted workflow exposes long-lived repository secret · New
• Executor misinterprets the next PR field as a backport target · New
• Concurrency group drops pending backport runs · New
• Suffix allocation makes backport reruns non-idempotent · New
• Validator unnecessarily has pull request write permission · New
• Empty backport target incorrectly consumes the next PR field · New

What changed in this PR

Adds automated validation and creation of backport pull requests.

Changes:

• Validates backport_to targets in PR descriptions.
• Cherry-picks merged changes into selected release branches.
• Creates backport PRs and reports conflicts.

File	Description
.github/​workflows/​pr-validate-release.yml	Validates requested backport branches.
.github/​workflows/​backport.yml	Creates branches and PRs for merged backports.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.