[CI] Trigger backports when v* labels are added afterwards (elastic#234452)

## Summary
backport should now trigger if `vX.Y.Z` labels are added last -
introduce a concurrency group to avoid multiple runs

This was already done in elastic#225511
then reverted in elastic#226840

This time, we're also adding a concurrency group to avoid the multiple
runs (reason for the revert), and adding some wait time before the
backport is started in
(elastic/kibana-github-actions#62)

Also, as per @mistic's suggestion, we're calculating the do/don't in a
javascript block, so that we're not struggling with inline condition
language.

Author: delanni

.github/workflows/_fixtures_/github_event_onmerge_1.json

@@ -0,0 +1,18 @@
+{
+  "_description": "GitHub event payload for a pull request merge event. The PR is merged, action should always run.",
+  "action": "closed",
+  "number": 42,
+  "pull_request": {
+    "merged": true,
+    "labels": [
+      { "name": "backport:any" },
+      { "name": "bugfix" }
+    ],
+    "base": {
+      "ref": "main"
+    },
+    "head": {
+      "ref": "feature-branch"
+    }
+  }
+}

.github/workflows/_fixtures_/github_event_onmerge_2.json

@@ -0,0 +1,18 @@
+{
+  "_description": "GitHub event payload for a pull request merge event. The PR is labelled, has version and targets.",
+  "action": "labeled",
+  "number": 42,
+  "pull_request": {
+    "merged": true,
+    "labels": [
+      { "name": "backport:version" },
+      { "name": "v9.2.1" }
+    ],
+    "base": {
+      "ref": "main"
+    },
+    "head": {
+      "ref": "feature-branch"
+    }
+  }
+}

.github/workflows/_fixtures_/github_event_onmerge_3.json

@@ -0,0 +1,17 @@
+{
+  "_description": "GitHub event payload for a pull request merge event. The PR is labelled, has backport:all-open, should trigger backports",
+  "action": "labeled",
+  "number": 42,
+  "pull_request": {
+    "merged": true,
+    "labels": [
+      { "name": "backport:all-open" }
+    ],
+    "base": {
+      "ref": "main"
+    },
+    "head": {
+      "ref": "feature-branch"
+    }
+  }
+}

.github/workflows/_fixtures_/github_event_onmerge_4.json

@@ -0,0 +1,17 @@
+{
+  "_description": "GitHub event payload for a pull request merge event. The PR is labelled, has backport:skip, should not trigger backports",
+  "action": "labeled",
+  "number": 42,
+  "pull_request": {
+    "merged": true,
+    "labels": [
+      { "name": "backport:skip" }
+    ],
+    "base": {
+      "ref": "main"
+    },
+    "head": {
+      "ref": "feature-branch"
+    }
+  }
+}

.github/workflows/on-merge.yml

@@ -5,22 +5,58 @@ on:
       - labeled
       - unlabeled
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   on-merge:
     name: 'Label and Backport'
     runs-on: ubuntu-latest
-    if: |
-      github.event.pull_request.merged == true &&
-        (github.event.action == 'closed' ||
-          (github.event.action == 'labeled' &&
-            (github.event.label.name == 'backport:all-open' ||
-              github.event.label.name == 'backport:version')) ||
-          (github.event.action == 'unlabeled' &&
-            github.event.label.name == 'backport:skip' &&
-            (contains(github.event.pull_request.labels.*.name, 'backport:all-open') ||
-              contains(github.event.pull_request.labels.*.name, 'backport:version'))))
+    if: github.event.pull_request.merged == true
     steps:
+      - run: "echo hello!"
+      - name: Check out versions.json
+        uses: actions/checkout@v5
+        with:
+          repository: 'elastic/kibana'
+          ref: main
+          sparse-checkout: |
+            versions.json
+      - name: Check Event Qualifies
+        uses: actions/github-script@v7
+        id: check_event
+        with:
+          result-encoding: string
+          script: |
+              let shouldRun = false;
+              const backportLabels = { skip: 'backport:skip', allOpen: 'backport:all-open', version: 'backport:version' };
+              const { pull_request: pr, action } = context.payload;
+              const labels = pr.labels.map(l => l.name);
+              const validVersionLabels = require('./versions.json').versions
+                .map(v => v.version.split('.').slice(0,2).join('.'))
+                .map(v => RegExp(`^v${v}\.[0-9]{1,2}$`));
+              const labelsWarrantBackport = labels.includes(backportLabels.allOpen) || (
+                labels.includes(backportLabels.version) &&
+                labels.some(label => validVersionLabels.some(v => v.test(label)))
+              );
+
+              if (action === 'closed') {
+                core.info('PR was merged, proceeding');
+                shouldRun = true;
+              } else if ((action === 'labeled' || action === 'unlabeled') && labelsWarrantBackport) {
+                core.info('labelling action warrants backport, proceeding');
+                shouldRun = true;
+              } else {
+                core.info('event does not warrant backport action, skipping');
+                shouldRun = false;
+              }
+
+              core.info(`Should run on-merge action: ${shouldRun}`);
+              return shouldRun.toString();
+
       - name: Checkout Actions
+        if: ${{ steps.check_event.outputs.result == 'true' }}
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: 'elastic/kibana-github-actions'
@@ -29,9 +65,11 @@ jobs:
           persist-credentials: false
 
       - name: Install Actions
+        if: ${{ steps.check_event.outputs.result == 'true' }}
         run: npm install --production --prefix ./actions
 
       - name: Run On-Merge
+        if: ${{ steps.check_event.outputs.result == 'true' }}
         uses: ./actions/on-merge
         with:
           github_token: ${{secrets.KIBANAMACHINE_TOKEN}}