ci: allow backport workflow to use a PAT to trigger downstream CI (#655) (#853) (#857)

PRs opened with the default GITHUB_TOKEN do not trigger downstream
pull_request workflows (an anti-recursion safeguard), which is why
backport PRs land without CI running on them. Read the github_token
from BACKPORT_PAT first and fall back to GITHUB_TOKEN, so configuring
a repo/org secret named BACKPORT_PAT (PAT with repo scope) unlocks
CI on backport PRs without any further code change. Behavior is
unchanged when the secret is not configured.

(cherry picked from commit 9d9db1d)

Author: mcottontensor

.github/workflows/backport.yml

@@ -23,7 +23,13 @@ jobs:
       - name: Backport Action
         uses: sqren/backport-github-action@v8.9.3
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          # Prefer a PAT when configured. PRs opened with the default
+          # GITHUB_TOKEN don't trigger downstream `pull_request` workflows
+          # (anti-recursion limit), which means CI does not run on backport
+          # PRs. Configure a repo or org secret named BACKPORT_PAT
+          # (PAT with `repo` scope) to fix that. Falls back to GITHUB_TOKEN
+          # if the secret is not set, preserving the prior behavior.
+          github_token: ${{ secrets.BACKPORT_PAT || secrets.GITHUB_TOKEN }}
           auto_backport_label_prefix: auto-backport-to-
           add_original_reviewers: true