chore: Require ready-to-merge label to run all checks (#6686)

* chore: Require `ready-to-merge` label to run all checks

* Always run `Ready-to-merge gate` job to avoid unintended skips

* Rename `ready` to `ready-to-merge-gate`

* Add documentation for ready to merge label

* Add comment to gate workflow

* Improve label logic

* Add debug step (will remove later)

* More debugging

* Improve condition

* Fix check

* Fix check

Author: itaybre

.github/workflows/build.yml

@@ -7,6 +7,7 @@ on:
       - release/**
 
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
 
 # Concurrency configuration:
 # - We use workflow-specific concurrency groups to prevent multiple build runs of the same code,
@@ -20,9 +21,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  ready-to-merge-gate:
+    name: Ready-to-merge gate
+    uses: ./.github/workflows/ready-to-merge-workflow.yml
+    with:
+      is-pr: ${{ github.event_name == 'pull_request' }}
+      labels: ${{ toJson(github.event.pull_request.labels) }}
+
   files-changed:
     name: Detect File Changes
     runs-on: ubuntu-latest
+    needs: ready-to-merge-gate
     outputs:
       run_build_for_prs: ${{ steps.changes.outputs.run_build_for_prs }}
     steps:

.github/workflows/ready-to-merge-workflow.yml

@@ -0,0 +1,41 @@
+name: Ready to Merge Workflow
+on:
+  workflow_call:
+    inputs:
+      labels:
+        description: The GitHub event's labels
+        required: true
+        type: string
+      is-pr:
+        description: Whether the workflow is running on a PR
+        required: true
+        type: boolean
+
+jobs:
+  ready-to-merge-gate:
+    name: 'Missing "ready-to-merge" label'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for exact 'ready-to-merge' label
+        if: ${{ inputs.is-pr }}
+        id: check-label
+        run: |
+          # Use jq to check for exact label match (avoids substring matching issues with contains())
+          if echo '${{ inputs.labels }}' | jq -e '.[] | select(.name == "ready-to-merge")' > /dev/null; then
+            echo "label_found=true" >> $GITHUB_OUTPUT
+          else
+            echo "label_found=false" >> $GITHUB_OUTPUT
+          fi
+      # Since Github also accepts `skipped` results for Required Workflows, we need
+      # to fail the job to ensure that the downstream jobs don't just skip.
+      - name: Fail until the 'ready-to-merge' label is present
+        if: ${{ inputs.is-pr && steps.check-label.outputs.label_found == 'false' }}
+        run: |
+          echo "Add the 'ready-to-merge' label to run CI."
+          exit 1
+      - name: Gate passed
+        if: ${{ inputs.is-pr && steps.check-label.outputs.label_found == 'true' }}
+        run: echo "Label present. Proceeding with CI."
+      - name: Gate passed
+        if: ${{ !inputs.is-pr }}
+        run: echo "Not a PR. Proceeding with CI."

.github/workflows/release.yml

@@ -8,6 +8,7 @@ on:
       - v8.x
 
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
 
   workflow_dispatch:
     inputs:
@@ -33,9 +34,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  ready-to-merge-gate:
+    name: Ready-to-merge gate
+    uses: ./.github/workflows/ready-to-merge-workflow.yml
+    with:
+      is-pr: ${{ github.event_name == 'pull_request' }}
+      labels: ${{ toJson(github.event.pull_request.labels) }}
+
   files-changed:
     name: Detect File Changes
     runs-on: ubuntu-latest
+    needs: ready-to-merge-gate
     outputs:
       run_release_for_prs: ${{ steps.changes.outputs.run_release_for_prs }}
     steps:

.github/workflows/test.yml

@@ -7,6 +7,7 @@ on:
       - release/**
 
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
 
 # Concurrency configuration:
 # - We use workflow-specific concurrency groups to allow independent test runs across different workflows
@@ -20,6 +21,13 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  ready-to-merge-gate:
+    name: Ready-to-merge gate
+    uses: ./.github/workflows/ready-to-merge-workflow.yml
+    with:
+      is-pr: ${{ github.event_name == 'pull_request' }}
+      labels: ${{ toJson(github.event.pull_request.labels) }}
+
   # This job detects if the PR contains changes that require running unit tests.
   # If yes, the job will output a flag that will be used by the next job to run the unit tests.
   # If no, the job will output a flag that will be used by the next job to skip running the unit tests.
@@ -28,6 +36,7 @@ jobs:
   files-changed:
     name: Detect File Changes
     runs-on: ubuntu-latest
+    needs: ready-to-merge-gate
     # Map a step output to a job output
     outputs:
       run_unit_tests_for_prs: ${{ steps.changes.outputs.run_unit_tests_for_prs }}

.github/workflows/ui-tests-critical.yml

@@ -6,6 +6,7 @@ on:
       - v8.x
 
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
 
 # Concurrency configuration:
 # - We use workflow-specific concurrency groups to prevent multiple critical UI test runs,
@@ -19,9 +20,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  ready-to-merge-gate:
+    name: Ready-to-merge gate
+    uses: ./.github/workflows/ready-to-merge-workflow.yml
+    with:
+      is-pr: ${{ github.event_name == 'pull_request' }}
+      labels: ${{ toJson(github.event.pull_request.labels) }}
+
   files-changed:
     name: Detect File Changes
     runs-on: ubuntu-latest
+    needs: ready-to-merge-gate
     outputs:
       run_ui_tests_critical_for_prs: ${{ steps.changes.outputs.run_ui_tests_critical_for_prs }}
     steps:

.github/workflows/ui-tests.yml

@@ -6,6 +6,7 @@ on:
       - v8.x
 
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
 
 # Concurrency configuration:
 # - We use workflow-specific concurrency groups to prevent multiple UI test runs on the same code,
@@ -19,9 +20,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  ready-to-merge-gate:
+    name: Ready-to-merge gate
+    uses: ./.github/workflows/ready-to-merge-workflow.yml
+    with:
+      is-pr: ${{ github.event_name == 'pull_request' }}
+      labels: ${{ toJson(github.event.pull_request.labels) }}
+
   files-changed:
     name: Detect File Changes
     runs-on: ubuntu-latest
+    needs: ready-to-merge-gate
     outputs:
       run_ui_tests_for_prs: ${{ steps.changes.outputs.run_ui_tests_for_prs }}
     steps:

develop-docs/CI.md

@@ -0,0 +1,25 @@
+# CI inner working
+
+## `ready-to-merge` label
+
+CI checks are great, but macOS runners are limited on every provider, because of this, we need to be smarter on how we run jobs.
+To avoid running many jobs on every PR's commit, we have decided to only run a subset of tests regularily and run the full suite only when the PR has the label `ready-to-merge`.
+
+### How to use the gate
+
+Add this job at the start the workflow and then add `need: ready-to-merge-gate` to jobs that you want to be skipped.
+
+```
+ready-to-merge-gate:
+  name: Ready-to-merge gate
+  uses: ./.github/workflows/ready-to-merge-workflow.yml
+  with:
+    is-pr: ${{ github.event_name == 'pull_request' }}
+    labels: ${{ toJson(github.event.pull_request.labels) }}
+```
+
+This job will:
+
+- Pass if the event is not a PR
+- Fail if the event is a PR and is missing the `ready-to-merge` label
+- Pass if the event is a PR and is has the `ready-to-merge` label