[mrodm]

Proposed commit message

Rework the two-workflow backport checklist pattern. The previous design
ran `backport-packages-detect.yml` on `pull_request` events (restricted,
fork-safe context) and used a `workflow_run` trigger in
`post-backport-checklist.yml` to post the checklist with write
permissions. This two-step indirection was introduced for fork safety but
added complexity and introduced a security concern when using artifacts
in forks with the `pull_request` event.

What changed:

• backport-packages-detect.yml now triggers on push to main (post-merge) instead of pull_request. It owns the full pipeline: find the merged PR via the GitHub API, detect changed packages, and post/update the checklist comment. Push events always run in the base repository context, so the fork-safety concern disappears entirely — no artifact, no workflow_run indirection.

• post-backport-checklist.yml is deleted. Its logic is absorbed into the detect workflow.

• auto-backport.yml drops the push trigger. The checklist is now posted after merge, so there are no pre-checked branches at push time. The workflow is now purely issue_comment:edited driven. Additional hardening:

  • Job-level if: now also requires github.event.comment.user.login == 'github-actions[bot]' so only edits to the bot-posted checklist trigger the workflow.
  • cancel-in-progress set to false to prevent mid-cherry-pick cancellation when a user checks multiple boxes in quick succession. Runs are idempotent (deduplication via gh pr list), so queuing is safe.

• The checklist comment now includes a cc @author @merger line so both the PR author and the person who merged it are notified. The merger is fetched from the full PR object (/pulls/{number}) since merged_by is absent from the list representation returned by /commits/{sha}/pulls.

• Checklist comment intro text updated to reflect the post-merge workflow: removed the stale "updated on each push" and "on merge" wording.

Why:

Moving the trigger to push to main addresses the security concern around artifacts in forks with the pull_request event more cleanly than the workflow_run approach: it eliminates the attack surface entirely rather than patching around it. The checklist appears on the merged PR; authors check boxes after merge, which triggers auto-backport.yml via issue_comment:edited.

Author's Checklist

• Workflows tested end-to-end: same-repo PR merge and issue_comment:edited trigger
• YAML validated with yq for all modified workflow files
• Checklist comment rendering verified (render-checklist unit tests pass)

How to test this PR locally

1. Merge a PR to main on a fork — verify the detect workflow runs, finds the PR, detects packages, and posts a checklist comment with cc @author @merger.
2. Check a box in the posted checklist comment — verify auto-backport.yml triggers and processes only that branch.
3. Check two boxes in rapid succession — verify the second run queues rather than cancels the first, and both backport PRs are created.
4. Merge a PR with the backport:sync-changelog label — verify no checklist is posted.
5. Have a user without write access attempt to check a box — verify behaviour (expected: GitHub rejects the edit).

Example test runs:

• Update field kubernetes (5) mrodm/integrations#89
• Update field kubernetes (6) mrodm/integrations#91

Related issues

• Relates backport: post a backport checklist automatically on pull requests targeting main #19213
• Relates backport: automate backport PR creation from checklist and fix changelog links #19214
• Supersedes fix: rework backport checklist workflows to detect packages in the privileged job #21699 — this PR takes a simpler approach: a single workflow triggered on push to main posts the checklist once the PR is merged, removing the need for the two-workflow pull_request + workflow_run pattern introduced in fix: rework backport checklist workflows to detect packages in the privileged job #21699
• Closes Security research PoC: artifact poisoning lets a fork PR control the target issue of the privileged backport-checklist workflow #21660

---

This PR was generated with the assistance of Claude (claude-sonnet-4-6).

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: d735d45

cc @mrodm

[Copilot]

Copilot review overview

🟢 Approval recommended

The consolidated workflow removes the untrusted artifact boundary while preserving package detection, authorization, and backport behavior.

Review effort: Balanced
Findings: None

What changed in this PR

Consolidates post-merge backport checklist generation into one safer workflow and hardens automatic backport execution.

Changes:

• Posts checklists from trusted push events and removes artifact handoff.
• Restricts auto-backports to authorized edits of bot-authored checklists.
• Updates checklist messaging and notifications.

File	Description
cmd/​backport/​backports/​checklist/​checklist.go	Updates post-merge checklist guidance.
cmd/​backport/​backports/​checklist/​checklist_test.go	Updates expected checklist text.
.github/​workflows/​post-backport-checklist.yml	Removes the superseded consumer workflow.
.github/​workflows/​backport-packages-detect.yml	Detects packages and posts checklists after merge.
.github/​workflows/​auto-backport.yml	Hardens and serializes checklist-triggered backports.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.