CI: Auto label PRs with pr-blocked: fix-regression

.github/workflows/pr-automation.yml

@@ -9,18 +9,23 @@ name: Maintenance - PR automation
 on:
   pull_request_target:  # 'pull_request' can have no write permissions
     types: [opened, synchronize, reopened, closed]
+  workflow_run:  # To react to the result of a workflow on a pull request
+    workflows: ["Regression"]
+    types: [completed]
 
 permissions:
+  actions: read  # To download the artifacts of the triggering run
   pull-requests: write
 
 defaults:
   run:
     shell: bash
 
-# Single job, to avoid startup churn. Use separate gated steps for actions
+# One job per event source, to avoid startup churn. Use separate gated steps for actions
 jobs:
-  automate:
-    name: Automate
+  pr-event:
+    name: PR event
+    if: ${{ github.event_name == 'pull_request_target' }}
     runs-on: ubuntu-slim
     env:
       GH_TOKEN: ${{ github.token }}
@@ -61,3 +66,50 @@ jobs:
               --repo "${{ github.repository }}" \
               --remove-label "${LABELS}"
           fi
+
+  regression-complete:
+    name: Regression complete
+    if: |
+      github.event_name == 'workflow_run'
+      && github.event.workflow_run.name == 'Regression'
+      && github.event.workflow_run.event == 'pull_request'
+      && (github.event.workflow_run.conclusion == 'success'
+          || github.event.workflow_run.conclusion == 'failure')
+    runs-on: ubuntu-slim
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: "Set the 'pr-blocked: fix-regression' label from the result"
+        env:
+          SHA: ${{ github.event.workflow_run.head_sha }}
+          LABEL: "pr-blocked: fix-regression"
+          FAILED: ${{ github.event.workflow_run.conclusion == 'failure' }}
+        run: |-
+          # The run tells us which pull request it was for
+          if ! gh run download "${{ github.event.workflow_run.id }}" --name pr-number; then
+            echo "Run has no 'pr-number' artifact"
+            exit 0
+          fi
+          PR=$(cat pr-number.txt)
+          # Its state and head as they are now, and whether it carries the
+          # label already
+          read -r STATE HEAD LABELLED < <(gh pr view "${PR}" \
+            --repo "${{ github.repository }}" \
+            --json state,headRefOid,labels \
+            --jq '"\(.state) \(.headRefOid) \(any(.labels[]; .name == env.LABEL))"')
+          # Only act on a change, so a run does not reapply what is already set
+          if [ "${STATE}" != OPEN ]; then
+            # Closing removes all 'pr*' labels, do not put one back on
+            echo "PR #${PR} is ${STATE}"
+          elif [ "${HEAD}" != "${SHA}" ]; then
+            # Pushed to since, so this result is stale and a new run will decide
+            echo "PR #${PR} has moved on from ${SHA}"
+          elif [ "${FAILED}" = true ] && [ "${LABELLED}" = false ]; then
+            echo "Regression failed, blocking PR #${PR}"
+            gh pr edit "${PR}" --repo "${{ github.repository }}" --add-label "${LABEL}"
+          elif [ "${FAILED}" = false ] && [ "${LABELLED}" = true ]; then
+            echo "Regression succeeded, unblocking PR #${PR}"
+            gh pr edit "${PR}" --repo "${{ github.repository }}" --remove-label "${LABEL}"
+          else
+            echo "No change to PR #${PR}"
+          fi

.github/workflows/regression.yml

@@ -61,6 +61,18 @@ jobs:
       - name: Enabled
         run: echo "Regression is enabled for this run"
 
+      - name: Save the pull request number
+        if: ${{ github.event_name == 'pull_request' }}
+        run: echo "${{ github.event.number }}" > pr-number.txt
+
+      - name: Upload the pull request number
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        with:
+          name: pr-number
+          path: pr-number.txt
+          overwrite: true
+
   build-2604-gcc:
     name: Build | 26.04 | gcc
     needs: start