[migration] Make the SkiaSharp Skia fork transfer-ready before the org move

[mattleibow]

Parent tracker: #352

Cross-repository parent: mono/SkiaSharp#4959

Summary

Make the small set of repository-owned changes that can safely land before mono/skia moves to dotnet/skia.

The native fork has very little executable owner coupling. This issue focuses on owner-neutral contributor templates, explicit Backport permissions, and destination-policy readiness. It must not rewrite Google Skia upstream identities or pre-flip contact links to a repository that does not yet exist.

Desired end state

Before transfer:

• Contributor templates do not instruct users to copy mono/SkiaSharp URLs.
• Backport behavior does not depend on source-organization default token permissions.
• The third-party Backport action is pinned/approved for destination policy.
• There are no machine-consumed mono/skia self-references in the tracked tree.

At transfer, the only expected in-repo identity edit is the static issue contact links in .github/ISSUE_TEMPLATE/config.yml.

Implementation checklist

Make the pull request template owner-neutral

• Replace Related to https://github.com/mono/SkiaSharp/issues/<issue-number> with an owner-neutral issue URL placeholder.
• Replace Requires https://github.com/mono/SkiaSharp/pull/<pr-number> with an owner-neutral PR URL placeholder.
• Replace Companion mono/SkiaSharp PR with Companion SkiaSharp PR.
• Preserve every existing ABI, C API, testing, and required-parent-PR checklist item.
• Do not point the template at dotnet/SkiaSharp before that repository exists.

Suggested wording:

Related SkiaSharp issue: <issue-url>
Requires SkiaSharp PR: <pull-request-url>

Declare explicit Backport workflow permissions

• Add explicit minimum permissions to .github/workflows/backport.yml.
• Include contents: write for backport branch creation.
• Include pull-requests: write for PR creation.
• Verify whether label application requires issues: write; include it only when required.
• Preserve current label-to-target-branch behavior.
• Preserve fork and untrusted-input safety.
• Do not depend on the destination organization's default GITHUB_TOKEN permission.

Pin and verify the Backport action

• Resolve the reviewed commit behind tibdex/backport@v2.
• Pin the action to a full commit SHA with a version comment.
• Confirm the action and transitive behavior are allowed by expected dotnet policy.
• Document destination Actions-policy dependencies in the parent migration tracker.

Confirm executable identity inventory

• Add or run a check proving there are no machine-consumed mono/skia self-references.
• Confirm there are no owner-qualified action/reusable-workflow calls.
• Confirm there are no old-owner raw/API fetches.
• Confirm there is no Pages, package-publishing, Azure Pipeline, or submodule config to migrate here.
• Leave the 42 fork-patch mono/skia comments unchanged.
• Leave the historical mono/SkiaSharp#1409 source comment unchanged.

Document intentional cutover-only links

The static issue contact links in .github/ISSUE_TEMPLATE/config.yml must remain on the live repository until dotnet/SkiaSharp exists.

• Record these as the only expected in-repo cutover edits.
• Do not replace them with broken destination URLs in this PR.

Explicitly out of scope

• Changing mono/skia to dotnet/skia in comments.
• Changing google/skia, skia.googlesource.com, Gerrit, LUCI, DEPS, or upstream raw URLs.
• Changing issue contact links before dotnet/SkiaSharp exists.
• Changing branch names, including skiasharp.
• Changing release branches or protections.
• Moving the repository or modifying GitHub/Azure/OIDC settings.
• Reworking the parent SkiaSharp upstream-sync implementation.

Validation

• Pull request template renders correctly.
• Backport workflow YAML is valid.
• Backport action is pinned to the reviewed SHA.
• Explicit permissions cover documented write operations.
• Existing backport label parsing remains unchanged.
• No executable old-owner self-reference is introduced.
• No Google upstream identity changes are present.
• Repository remains clean outside intended .github files.

Follow-up validation after merge

• Apply a test Backport label to a suitable controlled PR or branch scenario.
• Confirm the workflow creates the expected branch and PR.
• Confirm expected labels are applied.
• Record the successful run in [migration] Transfer the SkiaSharp Skia fork from mono to dotnet #352.

Completion criteria

• Contributor templates are organization-neutral.
• Backport has explicit least-privilege permissions and a pinned action.
• The repository has no machine-consumed dependency on mono/skia.
• The only planned transfer-day source edit is the static main-repository contact links.
• Changes remain functional while the repository is in mono.

[mattleibow]

Approved design change: PR #354 replaces tibdex/backport entirely with the standard dotnet/arcade/.github/workflows/backport-base.yml pinned at 306225d7029934938d109e18df390f04e366a68d.

The workflow intentionally changes from label-driven pull_request_target automation to comments on a merged PR: /backport to <branch> or /backport <branch>. Arcade verifies the commenter has write or admin, verifies the PR is merged and the target branch exists, then creates/updates backport/pr-<number>-to-<branch> with [<branch>] <title>, body Backport of #<source> to <target>, and label backport.

The caller grants contents, issues, pull-requests, and actions write permissions for branch push, PR comments/locking/labels, PR creation, and scheduled run cleanup respectively. repository_owners: mono,dotnet keeps it working across the move; remove mono after transfer.

Maintainers accept Arcade’s deterministic temporary-branch force push, nested cleanup workflow, and trusted-organization dependency update model as intentional standard .NET infrastructure behavior; they are not merge blockers. Current mono/skia protections do not conflict. The remaining transfer check is that destination organization policy allows dotnet/arcade reusable workflows.