From bd5ba2cc950b40f6528f76e7b02af7ec9d1218bc Mon Sep 17 00:00:00 2001
From: omer-vishlitzky <omer.vishlitzky@gmail.com>
Date: Fri, 7 Aug 2026 22:58:02 +0300
Subject: [PATCH] OSAC-3734: add label-gate workflow for merge queue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reads Prow-set labels (lgtm, approved, jira/valid-reference) and
converts their presence to a status check the merge queue can gate on.

Merge queue can only gate on status checks, not labels. Prow plugins
set labels via OWNERS files — this workflow bridges the gap.

Auto-passes on merge_group events since labels were already validated
on the PR.

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
---
 .github/workflows/label-gate.yml | 40 ++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/label-gate.yml

diff --git a/.github/workflows/label-gate.yml b/.github/workflows/label-gate.yml
new file mode 100644
index 0000000000..3c8e74a428
--- /dev/null
+++ b/.github/workflows/label-gate.yml
@@ -0,0 +1,40 @@
+---
+name: label-gate
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, labeled, unlabeled, synchronize, reopened]
+    branches: [main]
+  merge_group:
+
+jobs:
+  check-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Auto-pass for merge queue
+        if: github.event_name == 'merge_group'
+        run: echo "Labels already validated on PR"
+      - name: Check required Prow labels
+        if: github.event_name == 'pull_request'
+        env:
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: |
+          missing=()
+          for label in lgtm approved jira/valid-reference; do
+            if ! echo "$LABELS" | jq -e "index(\"$label\")" > /dev/null 2>&1; then
+              missing+=("$label")
+            fi
+          done
+          if [[ ${#missing[@]} -gt 0 ]]; then
+            echo "::error::Missing required labels: ${missing[*]}"
+            echo ""
+            echo "Required labels are set by Prow plugins via OWNERS files:"
+            echo "  lgtm           - reviewer types /lgtm"
+            echo "  approved       - approver types /approve"
+            echo "  jira/valid-reference - PR title has valid Jira key"
+            exit 1
+          fi
+          echo "All required labels present"