[migration] Transfer the SkiaSharp Skia fork from mono to dotnet

[mattleibow]

Parent tracker: mono/SkiaSharp#4959

Summary

Transfer the public SkiaSharp Skia fork from mono/skia to dotnet/skia while preserving its relationship to google/skia, its nonstandard skiasharp default branch, release branches, protections, tags, forks, Backport workflow, and parent-repository synchronization.

Known identity and baseline

• Repository ID: 52292286
• Parent/source: google/skia, repository ID 15773229
• Default branch: skiasharp
• Expected destination: dotnet/skia
• Baseline inventory: 210 branches, 178 protected branches, 151 tags, 67 direct forks, fork-network count 1,766

Phase 1: pre-move repository work

• Make .github/pull_request_template.md issue/PR placeholders owner-neutral.
• Make the companion SkiaSharp PR checklist owner-neutral.
• Add explicit least-privilege permissions to .github/workflows/backport.yml.
• Confirm Backport label handling permissions.
• Confirm tibdex/backport@v2 is allowed by dotnet Actions policy.
• Keep google/skia, skia.googlesource.com, Gerrit, LUCI, DEPS, and upstream raw URLs unchanged.
• Leave historical fork-patch comments and old source issue links unchanged unless separately cleaned up.

Phase 2: pre-move infrastructure

Fork-network eligibility

• Confirm dotnet/skia does not exist.
• Confirm dotnet owns no private or differently named repository in the google/skia fork network.
• Open the transfer preflight/dialog with a dotnet owner without confirming the transfer.
• Abort if GitHub reports a fork-network conflict.

Repository settings

• Export all 210 branch refs and 151 tags.
• Export all 178 branch protections and applicable rulesets.
• Export labels, issues, PRs, merge settings, Apps, hooks, keys, teams, and issue types.
• Pre-create matching destination issue types and team access.
• Confirm destination rules preserve skiasharp as the default/protected branch.

Automation and credentials

• Locate and assign an owner for the producer of skia-sync/* branches and PRs.
• Confirm the parent SkiaSharp workflow derives this repository from one configured identity.
• Grant the parent sync/release token write access to incoming dotnet/skia.
• Reauthorize Copilot and other selected-repository Apps.
• Reauthorize/replace fine-grained PATs and validate SSO/IP policy.
• Prepare immutable OIDC credentials using repo:dotnet@9141961/skia@52292286:.
• Search Azure and external automation for mono/skia.

Phase 3: move window

• Freeze Backport, upstream sync, release branch creation, and other writes.
• Record final branch/tag/protection/fork counts and open sync PRs.
• Re-run the destination name and fork-network preflight.
• Transfer mono/skia to dotnet/skia.
• Confirm repository ID remains 52292286.
• Confirm parent/source remains google/skia.
• Confirm default branch remains skiasharp.
• Apply destination teams, protections/rulesets, issue types, Apps, and security settings.
• Update external remotes and service bindings.
• Change issue contact links to dotnet/SkiaSharp after that repository exists.
• Keep the old mono/skia namespace unused.

Phase 4: post-move validation

Repository integrity

• All 210 branches are present.
• All 151 tags are present.
• Intended branch protections/rulesets are effective.
• Direct forks and the full fork network remain associated.
• Open PRs and issues are intact.
• Old and new Git web/fetch URLs work.

Automation

• Run a harmless Backport test against an existing release branch.
• Backport creates the expected branch and PR and applies expected labels.
• Parent SkiaSharp sync can fetch dotnet/skia.
• Parent SkiaSharp sync can compare upstream through the GitHub API.
• Parent automation can push a guarded update branch.
• Parent automation can create/update a companion Skia PR.
• Release preparation creates/verifies matching Skia release branches.
• Copilot/dynamic workflows run under destination policy.
• Actual immutable-subject OIDC login succeeds if any external integration uses OIDC.

Proposed sub-issues

• Make Skia PR templates owner-neutral.
• Declare explicit Backport workflow permissions.
• Verify dotnet has no google/skia fork-network conflict.
• Reauthorize Skia sync and release automation for dotnet/skia.
• Validate the Skia fork after transfer.

Completion criteria

• dotnet/skia has repository ID 52292286.
• It remains a fork of google/skia.
• skiasharp, release branches, tags, protections, forks, issues, and PRs are intact.
• Backport, upstream sync, and release branch automation have completed successfully.
• mono/skia remains unused and redirects continue to work.

[mattleibow]

Pre-move readiness is implemented in #354 using the standard .NET-owned Arcade Backport workflow. The Skia caller pins dotnet/arcade/.github/workflows/backport-base.yml to reviewed commit 306225d7029934938d109e18df390f04e366a68d and grants explicit contents, issues, pull-requests, and actions write permissions for branch push, PR comments/locking/labels, PR creation, and scheduled workflow-run cleanup.

The UX intentionally changes from labels to /backport to <branch> or /backport <branch> comments by collaborators with write or admin. repository_owners: mono,dotnet supports both sides of the move; remove mono after transfer. The three .github/ISSUE_TEMPLATE/config.yml links remain deliberately on the live mono/SkiaSharp repository and are the only transfer-day source-link edits.

Maintainers accept Arcade’s deterministic temporary-branch force push, nested cleanup workflow, and trusted-organization dependency update model as intentional standard .NET infrastructure behavior; they are not migration blockers. Current mono/skia protections do not conflict. The remaining destination-policy check is that the dotnet organization allows dotnet/arcade reusable workflows.