ci: add reusable label-driven backport workflow

[ionite34]

Lifts StabilityMatrix's backport.yml into an org-level reusable workflow (same pattern as csharpier-check.yml) so all repos get label-driven backports from a thin caller:

name: Automatic Backport
on:
  pull_request:
    types: [closed, labeled]
permissions:
  contents: write
  pull-requests: write
  issues: write
jobs:
  backport:
    uses: LykosAI/.github/.github/workflows/backport.yml@main
    secrets: inherit

lykos-backport GitHub App (optional, graceful)

When the org variable BACKPORT_APP_ID and org secret BACKPORT_APP_PRIVATE_KEY are set (reached via the caller's secrets: inherit), the workflow mints an installation token with actions/create-github-app-token@v3. Backport PRs are then authored by the lykos-backport App — its name + avatar — and, crucially, trigger CI (PRs opened with the default GITHUB_TOKEN don't). The if: vars.BACKPORT_APP_ID != '' gate means it skips cleanly and falls back to GITHUB_TOKEN when the App isn't configured, so this can merge before the App exists.

Differences from the SM original

• mainline defaults to 1 unconditionally. SM computed 1 for merges to dev, else 2 — from a trial-and-error fix ("Fix mainline maybe", June 2024). For a standard GitHub merge commit, parent 1 is always the base-branch side, so -m 1 replays exactly the PR's changes for any base branch. The else 2 path was never exercised (all SM backports were dev→main). Still overridable via input.
• No third-party create-json action — config written with a plain run step.
• The merged+labeled guard lives in the reusable job, so callers stay thin and can't forget it.
• commitConflicts is a real boolean instead of the string "true".

Inputs (target_pr_labels, auto_backport_label_prefix, mainline, pr_title) default to SM's current values.

Callers (merge after this — they reference @main): StabilityMatrix#1674, Lykos.Chat.Api#33, Lykos.Chat.Web#20.

🤖 Generated with Claude Code

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.