QVAC-18612 infra: gate every secret-bearing workflow with label-gate

.github/workflows/benchmark-chatterbox-tts-onnx.yml

@@ -69,8 +69,30 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+
   benchmark-chatterbox:
-    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'onnx-tts-v'))
+    needs: [label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'onnx-tts-v')))
     runs-on: macos-14-xlarge
     environment: release
     timeout-minutes: 180

.github/workflows/benchmark-embed-llamacpp.yml

@@ -134,7 +134,30 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+
   benchmark:
+    needs: [label-gate]
+    if: needs.label-gate.outputs.authorised == 'true'
     runs-on: ai-run-linux-gpu
     environment: release
     timeout-minutes: 180
@@ -412,4 +435,4 @@ jobs:
           path: |
             ${{ env.WORKDIR }}/benchmarks/server/server.log
             ${{ env.WORKDIR }}/logs/
-          retention-days: 90
+          retention-days: 90

.github/workflows/benchmark-llm-llamacpp.yml

@@ -178,7 +178,30 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+
   benchmark:
+    needs: [label-gate]
+    if: needs.label-gate.outputs.authorised == 'true'
     runs-on: ai-run-linux-gpu
     environment: release
     timeout-minutes: 180

.github/workflows/benchmark-ocr-onnx.yml

@@ -31,6 +31,27 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+
   setup:
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -59,8 +80,8 @@ jobs:
           fi
 
   build:
-    needs: setup
-    if: needs.setup.outputs.qvac_needed == 'true'
+    needs: [setup, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && needs.setup.outputs.qvac_needed == 'true'
     runs-on: ubuntu-24.04
     environment: release
     timeout-minutes: 120
@@ -148,11 +169,8 @@ jobs:
           retention-days: 1
 
   evaluate:
-    needs: [setup, build]
-    if: |
-      always() &&
-      needs.setup.result == 'success' &&
-      (needs.build.result == 'success' || needs.build.result == 'skipped')
+    needs: [setup, build, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && (always() && needs.setup.result == 'success' && (needs.build.result == 'success' || needs.build.result == 'skipped'))
     runs-on: ubuntu-24.04
     environment: release
     timeout-minutes: 180

.github/workflows/benchmark-performance-infer-llm-llamacpp.yml

@@ -43,6 +43,27 @@ permissions:
   id-token: write
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+
   context:
     runs-on: ubuntu-latest
     outputs:
@@ -63,7 +84,8 @@ jobs:
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
   prebuild:
-    needs: context
+    needs: [context, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true'
     permissions:
       contents: write
       packages: write
@@ -76,8 +98,8 @@ jobs:
       ref: ${{ needs.context.outputs.ref }}
 
   desktop-benchmarks:
-    needs: [context, prebuild]
-    if: ${{ inputs.run_desktop }}
+    needs: [context, prebuild, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && inputs.run_desktop
     permissions:
       contents: read
       packages: read
@@ -92,8 +114,8 @@ jobs:
       qvac_perf_only: true
 
   mobile-benchmarks:
-    needs: [context, prebuild]
-    if: ${{ inputs.run_mobile }}
+    needs: [context, prebuild, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && inputs.run_mobile
     permissions:
       contents: read
       packages: read
@@ -112,8 +134,8 @@ jobs:
     # `if: always()` lets summarize run even when one of the benchmark
     # jobs was skipped via the run_desktop / run_mobile toggles or
     # failed mid-run; we still want the partial report.
-    needs: [context, desktop-benchmarks, mobile-benchmarks]
-    if: ${{ always() && needs.context.result == 'success' }}
+    needs: [context, desktop-benchmarks, mobile-benchmarks, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && always() && needs.context.result == 'success'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/benchmark-performance-transcription-parakeet.yml

@@ -18,6 +18,27 @@ permissions:
   id-token: write
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+
   context:
     runs-on: ubuntu-latest
     outputs:
@@ -38,7 +59,8 @@ jobs:
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
   prebuild:
-    needs: context
+    needs: [context, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true'
     permissions:
       contents: write
       packages: write
@@ -51,7 +73,8 @@ jobs:
       ref: ${{ needs.context.outputs.ref }}
 
   desktop-benchmarks:
-    needs: [context, prebuild]
+    needs: [context, prebuild, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true'
     permissions:
       contents: read
       packages: read
@@ -65,8 +88,8 @@ jobs:
       run_rtf_benchmarks: true
 
   summarize:
-    needs: [context, desktop-benchmarks]
-    if: always()
+    needs: [context, desktop-benchmarks, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && always()
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/benchmark-performance-transcription-whispercpp.yml

@@ -23,6 +23,27 @@ permissions:
   id-token: write
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+
   context:
     runs-on: ubuntu-latest
     outputs:
@@ -46,7 +67,8 @@ jobs:
           echo "include_desktop=${INPUT_INCLUDE_DESKTOP}" >> "$GITHUB_OUTPUT"
 
   prebuild:
-    needs: context
+    needs: [context, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true'
     permissions:
       contents: write
       packages: write
@@ -59,8 +81,8 @@ jobs:
       ref: ${{ needs.context.outputs.ref }}
 
   desktop-benchmarks:
-    needs: [context, prebuild]
-    if: needs.context.outputs.include_desktop != 'false'
+    needs: [context, prebuild, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && needs.context.outputs.include_desktop != 'false'
     permissions:
       contents: read
       packages: read
@@ -73,10 +95,9 @@ jobs:
       run_integration_tests: false
       run_rtf_benchmarks: true
 
-
   summarize:
-    needs: [context, desktop-benchmarks]
-    if: always()
+    needs: [context, desktop-benchmarks, label-gate]
+    if: needs.label-gate.outputs.authorised == 'true' && always()
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -96,7 +117,6 @@ jobs:
           path: benchmark-artifacts/desktop
           merge-multiple: true
 
-
       - name: Generate consolidated benchmark report
         run: |
           node scripts/perf-report/aggregate-whisper-rtf.js \