From 7d702fcc7bccf96389aa9887a0c67378e35f39c8 Mon Sep 17 00:00:00 2001
From: bunnam988 <balajichowdary_unnam@comcast.com>
Date: Fri, 7 Aug 2026 16:13:42 +0530
Subject: [PATCH 1/3] Add explicit permissions to cherry-pick and gatekeeper
 jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without this, GITHUB_TOKEN defaults to read-only in rdkcentral org repos,
causing git push, gh pr create, and gh pr comment to fail with 403.

Reason for change: GITHUB_TOKEN is read-only by default; workflows need explicit write grants
Test Procedure: merge a PR, add cherry-pick label — PR auto-created without CROSS_REPO_TOKEN
Risks: Low
Priority: P0
---
 .github/workflows/cherry-pick.yml | 4 ++++
 .github/workflows/gatekeeper.yml  | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/cherry-pick.yml b/.github/workflows/cherry-pick.yml
index 886a977..53d99a7 100644
--- a/.github/workflows/cherry-pick.yml
+++ b/.github/workflows/cherry-pick.yml
@@ -25,6 +25,10 @@ on:
 jobs:
   backport:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write      # push cherry-pick branch
+      pull-requests: write # create PR and post comments
+      issues: write        # add labels to issues/PRs
     steps:
       - name: Extract Metadata & Propagate to Sister PRs
         id: parse_meta
diff --git a/.github/workflows/gatekeeper.yml b/.github/workflows/gatekeeper.yml
index 70cc27e..1274cdb 100644
--- a/.github/workflows/gatekeeper.yml
+++ b/.github/workflows/gatekeeper.yml
@@ -10,6 +10,9 @@ on:
 jobs:
   check-reviews:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # post step summary and read PR data
     steps:
       - name: Verify All Sister PRs Are Approved
         env:

From 23dac0b510ce6d09d062faddc426ad0b5f28871d Mon Sep 17 00:00:00 2001
From: bunnam988 <balajichowdary_unnam@comcast.com>
Date: Fri, 7 Aug 2026 16:17:31 +0530
Subject: [PATCH 2/3] =?UTF-8?q?Add=202>/dev/null=20||=20true=20to=20all=20?=
 =?UTF-8?q?gh=20pr=20comment=20calls=20=E2=80=94=20locked/inaccessible=20P?=
 =?UTF-8?q?Rs=20must=20not=20abort=20cherry-pick?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/cherry-pick.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/cherry-pick.yml b/.github/workflows/cherry-pick.yml
index 53d99a7..ac568aa 100644
--- a/.github/workflows/cherry-pick.yml
+++ b/.github/workflows/cherry-pick.yml
@@ -176,7 +176,7 @@ jobs:
 
             # Verify target branch exists
             if ! git fetch origin "$TARGET_BRANCH" 2>/dev/null; then
-              gh pr comment "$PR_URL" --body "$(printf '❌ **Cherry-pick failed:** Target branch \x60%s\x60 does not exist.\n\nPlease check the label for typos and ensure the branch has been created.' "$TARGET_BRANCH")"
+              gh pr comment "$PR_URL" --body "$(printf '❌ **Cherry-pick failed:** Target branch \x60%s\x60 does not exist.\n\nPlease check the label for typos and ensure the branch has been created.' "$TARGET_BRANCH")" 2>/dev/null || true
               echo "Error: Target branch '$TARGET_BRANCH' does not exist. Skipping."
               continue
             fi
@@ -202,7 +202,7 @@ jobs:
             done
 
             if [ "$EMPTY" = "true" ]; then
-              gh pr comment "$PR_URL" --body "$(printf 'ℹ️ **Cherry-pick to \x60%s\x60 skipped:** The changes already exist on the target branch.\n\nNo action needed — this commit was likely already applied manually.' "$TARGET_BRANCH")"
+              gh pr comment "$PR_URL" --body "$(printf 'ℹ️ **Cherry-pick to \x60%s\x60 skipped:** The changes already exist on the target branch.\n\nNo action needed — this commit was likely already applied manually.' "$TARGET_BRANCH")" 2>/dev/null || true
               echo "Cherry-pick skipped: changes already on $TARGET_BRANCH."
               git checkout --detach 2>/dev/null; git branch -D "$CHERRY_PICK_BRANCH" 2>/dev/null || true
               continue
@@ -213,7 +213,7 @@ jobs:
               if [ -n "$BACKPORT_LABEL" ]; then
                 LABEL_HINT=$(printf '\n\n> ⚠️ **Important:** Add the \x60%s\x60 label to your manual PR. This is required for cross-repo cascade — without it, sister repositories will not be triggered for further cherry-picks from this branch.' "$BACKPORT_LABEL")
               fi
-              gh pr comment "$PR_URL" --body "$(printf '⚠️ **Cherry-pick to \x60%s\x60 failed due to merge conflicts.**\n\nPlease resolve the conflicts manually and create a PR targeting \x60%s\x60.%s' "$TARGET_BRANCH" "$TARGET_BRANCH" "$LABEL_HINT")"
+              gh pr comment "$PR_URL" --body "$(printf '⚠️ **Cherry-pick to \x60%s\x60 failed due to merge conflicts.**\n\nPlease resolve the conflicts manually and create a PR targeting \x60%s\x60.%s' "$TARGET_BRANCH" "$TARGET_BRANCH" "$LABEL_HINT")" 2>/dev/null || true
               echo "Cherry-pick to $TARGET_BRANCH failed due to conflicts."
               git checkout --detach 2>/dev/null; git branch -D "$CHERRY_PICK_BRANCH" 2>/dev/null || true
               continue

From 11600dfea82866c933aca2cd57f53c6f11470211 Mon Sep 17 00:00:00 2001
From: bunnam988 <balajichowdary_unnam@comcast.com>
Date: Fri, 7 Aug 2026 16:19:51 +0530
Subject: [PATCH 3/3] =?UTF-8?q?Add=20step=20summary=20with=20per-branch=20?=
 =?UTF-8?q?results=20=E2=80=94=20always=20visible=20in=20Actions=20tab=20r?=
 =?UTF-8?q?egardless=20of=20PR=20lock=20state?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/cherry-pick.yml | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/cherry-pick.yml b/.github/workflows/cherry-pick.yml
index ac568aa..f3ccf35 100644
--- a/.github/workflows/cherry-pick.yml
+++ b/.github/workflows/cherry-pick.yml
@@ -158,6 +158,7 @@ jobs:
           fi
 
           # Process each target branch
+          SUMMARY="## 🍒 Cherry-Pick Results\n\n**Source PR:** [#${PR_NUMBER}](${PR_URL}) — ${PR_TITLE}\n\n| Target Branch | Result |\n|---|---|\n"
           while IFS= read -r TARGET_BRANCH; do
             [ -z "$TARGET_BRANCH" ] && continue
             echo ""
@@ -177,6 +178,7 @@ jobs:
             # Verify target branch exists
             if ! git fetch origin "$TARGET_BRANCH" 2>/dev/null; then
               gh pr comment "$PR_URL" --body "$(printf '❌ **Cherry-pick failed:** Target branch \x60%s\x60 does not exist.\n\nPlease check the label for typos and ensure the branch has been created.' "$TARGET_BRANCH")" 2>/dev/null || true
+              SUMMARY+="| \`$TARGET_BRANCH\` | ❌ Branch does not exist |\n"
               echo "Error: Target branch '$TARGET_BRANCH' does not exist. Skipping."
               continue
             fi
@@ -203,6 +205,7 @@ jobs:
 
             if [ "$EMPTY" = "true" ]; then
               gh pr comment "$PR_URL" --body "$(printf 'ℹ️ **Cherry-pick to \x60%s\x60 skipped:** The changes already exist on the target branch.\n\nNo action needed — this commit was likely already applied manually.' "$TARGET_BRANCH")" 2>/dev/null || true
+              SUMMARY+="| \`$TARGET_BRANCH\` | ℹ️ Already applied — skipped |\n"
               echo "Cherry-pick skipped: changes already on $TARGET_BRANCH."
               git checkout --detach 2>/dev/null; git branch -D "$CHERRY_PICK_BRANCH" 2>/dev/null || true
               continue
@@ -214,6 +217,7 @@ jobs:
                 LABEL_HINT=$(printf '\n\n> ⚠️ **Important:** Add the \x60%s\x60 label to your manual PR. This is required for cross-repo cascade — without it, sister repositories will not be triggered for further cherry-picks from this branch.' "$BACKPORT_LABEL")
               fi
               gh pr comment "$PR_URL" --body "$(printf '⚠️ **Cherry-pick to \x60%s\x60 failed due to merge conflicts.**\n\nPlease resolve the conflicts manually and create a PR targeting \x60%s\x60.%s' "$TARGET_BRANCH" "$TARGET_BRANCH" "$LABEL_HINT")" 2>/dev/null || true
+              SUMMARY+="| \`$TARGET_BRANCH\` | ⚠️ Conflict — resolve manually and open PR |\n"
               echo "Cherry-pick to $TARGET_BRANCH failed due to conflicts."
               git checkout --detach 2>/dev/null; git branch -D "$CHERRY_PICK_BRANCH" 2>/dev/null || true
               continue
@@ -221,6 +225,7 @@ jobs:
 
             # Push with error handling so remaining branches are still processed on failure
             if ! git push --force origin "$CHERRY_PICK_BRANCH" 2>/dev/null; then
+              SUMMARY+="| \`$TARGET_BRANCH\` | ❌ Push failed |\n"
               echo "⚠️ Failed to push $CHERRY_PICK_BRANCH. Skipping PR creation for $TARGET_BRANCH."
               git checkout --detach 2>/dev/null; git branch -D "$CHERRY_PICK_BRANCH" 2>/dev/null || true
               continue
@@ -234,28 +239,37 @@ jobs:
             # Create PR only if one doesn't already exist
             EXISTING_PR=$(gh pr list --repo "$REPO" --head "$CHERRY_PICK_BRANCH" --state open --json number --jq '.[0].number // empty')
             if [ -n "$EXISTING_PR" ]; then
+              SUMMARY+="| \`$TARGET_BRANCH\` | ℹ️ PR [#${EXISTING_PR}](https://github.com/${REPO}/pull/${EXISTING_PR}) already open — branch updated |\n"
               echo "ℹ️ Cherry-pick PR #$EXISTING_PR already exists for $CHERRY_PICK_BRANCH. Updated branch."
               git checkout --detach 2>/dev/null; git branch -D "$CHERRY_PICK_BRANCH" 2>/dev/null || true
               continue
             fi
 
+            CREATED_PR_URL=""
             if [ -n "$BACKPORT_LABEL" ]; then
-              gh pr create \
+              CREATED_PR_URL=$(gh pr create \
                 --repo "$REPO" \
                 --head "$CHERRY_PICK_BRANCH" \
                 --base "$TARGET_BRANCH" \
                 --title "$PR_TITLE" \
                 --body "Cherry-pick of #${PR_NUMBER} to \`$TARGET_BRANCH\`." \
-                --label "$BACKPORT_LABEL" || echo "⚠️ Failed to create PR for $TARGET_BRANCH."
+                --label "$BACKPORT_LABEL") || echo "⚠️ Failed to create PR for $TARGET_BRANCH."
             else
-              gh pr create \
+              CREATED_PR_URL=$(gh pr create \
                 --repo "$REPO" \
                 --head "$CHERRY_PICK_BRANCH" \
                 --base "$TARGET_BRANCH" \
                 --title "$PR_TITLE" \
-                --body "Cherry-pick of #${PR_NUMBER} to \`$TARGET_BRANCH\`." || echo "⚠️ Failed to create PR for $TARGET_BRANCH."
+                --body "Cherry-pick of #${PR_NUMBER} to \`$TARGET_BRANCH\`.") || echo "⚠️ Failed to create PR for $TARGET_BRANCH."
             fi
 
-            echo "✅ Cherry-pick PR created for $TARGET_BRANCH."
+            if [ -n "$CREATED_PR_URL" ]; then
+              SUMMARY+="| \`$TARGET_BRANCH\` | ✅ PR created: [${CREATED_PR_URL}](${CREATED_PR_URL}) |\n"
+              echo "✅ Cherry-pick PR created for $TARGET_BRANCH: $CREATED_PR_URL"
+            else
+              SUMMARY+="| \`$TARGET_BRANCH\` | ❌ PR creation failed |\n"
+            fi
             git checkout --detach 2>/dev/null; git branch -D "$CHERRY_PICK_BRANCH" 2>/dev/null || true
           done <<< "$TARGET_BRANCHES"
+
+          printf "%b\n" "$SUMMARY" >> "$GITHUB_STEP_SUMMARY"