[backport-security_detection_engine-9.4] (backport #21243) [sync-changelog] Assign sync PRs and always run from main - #21297

Proposed commit message

[sync-changelog] Assign sync PR to the backport PR author or merger

When creating the changelog sync PR, resolve the assignee from the
originating backport PR: use the PR author if they are an elastic org
member, otherwise fall back to whoever merged the PR. If the lookup
fails for any reason, the --assignee flag is omitted so PR creation
is not blocked.

[sync-changelog] Always load action and binary from main

Replace the local ./.github/actions/sync-backport-changelog reference
with elastic/integrations/.github/actions/sync-backport-changelog@main
in both the push and issue_comment jobs, so the action definition is
always fetched from main regardless of which backport branch triggered
the run.

Add an explicit checkout of main inside the action so the Go binary is
also always built from main's cmd/backport, not from a potentially
older backport branch.

[sync-changelog] Use bot flag and write access to resolve sync PR assignee

Replace the elastic org membership check (which required read:org scope
not available on GITHUB_TOKEN) with a collaborator permission check via
GET /repos/{repo}/collaborators/{login}/permission, which works with the
existing contents:write + pull-requests:write permissions.

Introduce prActor{Login, IsBot} parsed directly from the gh pr view JSON
so bot detection uses the API's own is_bot flag rather than string
matching. pickAssignee now guards both the author and mergedBy paths:
- Use author if not a bot and has write/maintain/admin access.
- Fall back to mergedBy if not a bot.
- Return empty string (skip --assignee) if neither qualifies.

What and Why

Assignee on sync PRs (cmd/backport/backports/changelog/sync.go)

Changelog sync PRs created by the sync-backport-changelog workflow had no assignee set, leaving them unowned. This change resolves the assignee automatically from the originating backport PR using the following logic:

1. Fetch the backport PR's author and mergedBy (including is_bot flag) in a single gh pr view call.
2. Use the author if they are not a bot and have write/maintain/admin access on the repo, checked via GET /repos/{repo}/collaborators/{login}/permission (works with the existing contents:write + pull-requests:write GITHUB_TOKEN permissions).
3. Otherwise fall back to mergedBy, as long as they are not a bot (the merger always has repo write access by definition).
4. If neither qualifies (e.g. both are bots), omit --assignee so PR creation is not blocked.

Always run from main (.github/workflows/sync-backport-changelog.yml, .github/actions/sync-backport-changelog/action.yml)

Previously the workflow loaded the composite action from the branch that triggered it (./.github/actions/sync-backport-changelog). Improvements merged to main would not apply to pushes on existing backport branches. This change:

• Switches both jobs (push and issue_comment) to reference elastic/integrations/.github/actions/sync-backport-changelog@main.
• Adds an explicit actions/checkout@v7 with ref: main inside the action so the Go binary is also always built from main's cmd/backport.
• Removes the now-redundant actions/checkout steps from the workflow (the action does its own checkout).

Author's Checklist

• pickAssignee is covered by unit tests (TestPickAssignee) including bot-author, external-contributor, and both-bots scenarios.
• Verified behaviour against real PRs changelog: security_detection_engine 9.4.12 (backport sync from PR #20998) #21002 and changelog: aws 6.22.0 (backport sync from PR #20972) #21127 — correct assignees resolved in both cases.

How to test this PR locally

1. Merge a PR into a backport branch that has a changelog.yml change.
2. Observe that the sync-backport-changelog workflow creates a sync PR with the correct assignee (the PR author if not a bot and has repo write access, otherwise the merger if not a bot).
3. Alternatively, comment /sync-changelog on a merged backport PR to trigger the retry path and verify the same.

Related issues

• Relates backport: deploy backport-branch automation workflows to active backport branches #19262
• Follows up backport: sync changelog entries from backport branches to main automatically #19215

This PR was generated with the assistance of Claude (claude-sonnet-4-6).