Add CI for api surface area review verification

Author: zoewangg

.github/workflows/api-surface-area-review-verification.yml

@@ -0,0 +1,33 @@
+name: API Surface Area Review Verification
+
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened, labeled, unlabeled ]
+    branches:
+      - master
+
+jobs:
+  api-surface-area-review-verification:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - id: api-surface-area-review-verification
+      - name: Verifies updates to protected/public APIs have been reviewed and approved by the team, if any
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'api-surface-area-approved-by-team') }}
+        run: |
+          git fetch origin ${{ github.base_ref }} --depth 1
+          echo "retrieving files"
+          FILES=$(git diff remotes/origin/${{ github.base_ref }} --name-only | grep "\.java$" | grep -v -E "(^|/)(internal|test|codegen|v2-migration)/")
+          echo "$FILES"
+          if [ -n "$FILES" ]; then
+            echo "::error::Changes around protected/public APIs found:"
+            echo "has_matches=true" >> $GITHUB_OUTPUT
+          else
+            echo "No changes around protected/public APIs found."
+            echo "has_matches=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Error message
+        if: steps.api-surface-area-review-verification.outputs.has_matches == 'true'
+        run: |
+          echo "::error ::Change around public/protected APIs has been detected, please review it with the team and add the 'api-surface-area-reviewed' label to this PR afterwards"
+          exit 1