feat: Add support for backport automation

[mvlassis]

Description

This PR adds backport automation to the repository.

Note: We choose track/1.0 as the track to automatically backport.

Closes #15

[ckfbot]

🤖 Backport labels populated

Labels to this pull request were added automatically by the populate-labels.yaml action.

When the PR is merged, backport PRs according to the labels will be automatically created. To skip the backport creation, remove any unneeded labels before merging the PR.

[Copilot]

Pull request overview

Adds GitHub Actions-based backport automation by creating/maintaining backport labels on PR open and generating backport PRs automatically after merge to main, driven by a configured list of backport tracks.

Changes:

• Add a PR-open workflow to populate backport labels for PRs targeting main.
• Add a PR-closed workflow (merged-only) to create backport PRs based on backport labels.
• Add a .github/automatic_backport_tracks.yaml config to define automatic backport tracks (e.g., track/1.0).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/on_pull_request.yaml	Calls reusable workflow to populate backport labels for PRs.
.github/workflows/on_pull_request_closed.yaml	Calls reusable workflow to create backport PRs on merge to main.
.github/automatic_backport_tracks.yaml	Declares the backport track list used by label population.

Suppressed comments (3)

.github/workflows/on_pull_request_closed.yaml:23

• This workflow inherits all caller secrets while invoking an external reusable workflow. Unless the called workflow explicitly needs additional secrets, prefer passing only the minimal required secrets (or none) to reduce blast radius if the dependency is compromised.

    uses: canonical/charmed-kubeflow-workflows/.github/workflows/backport-pr.yaml@main
    secrets: inherit

.github/workflows/on_pull_request.yaml:15

• The reusable workflow is referenced via a mutable ref (@main) while also inheriting all caller secrets. Pin the uses: reference to a tagged release or commit SHA and consider passing only the secrets actually required by the called workflow.

    if: github.base_ref == 'main' && (github.event.action == 'opened' || github.event.action == 'reopened')
    uses: canonical/charmed-kubeflow-workflows/.github/workflows/populate-labels.yaml@main
    secrets: inherit

.github/workflows/on_pull_request.yaml:15

• Because this runs on the pull_request event, GitHub will provide a read-only token for PRs from forks; in that case the label-population job won't be able to create/update labels. If you need this automation to work for forked PRs, consider a pull_request_target-based approach (ensuring the called workflow does not check out or execute untrusted PR code).

  populate-labels:
    name: Populate labels
    if: github.base_ref == 'main' && (github.event.action == 'opened' || github.event.action == 'reopened')
    uses: canonical/charmed-kubeflow-workflows/.github/workflows/populate-labels.yaml@main
    secrets: inherit

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ckfbot]

Successfully created backport PR for track/1.0:

• feat: Add support for backport automation (backport #16) #18