QVAC-18612 infra: gate every secret-bearing workflow with label-gate (re-land)

.github/workflows/benchmark-chatterbox-tts-onnx.yml

@@ -69,8 +69,28 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
   benchmark-chatterbox:
-    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'onnx-tts-v'))
+    if: needs.label-gate.outputs.authorised == 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'onnx-tts-v')))
     runs-on: macos-14-xlarge
     environment: release
     timeout-minutes: 180
@@ -508,3 +528,5 @@ jobs:
           fi
 
           rm -f /tmp/sa-credentials.json
+    needs:
+      - label-gate

.github/workflows/benchmark-embed-llamacpp.yml

@@ -134,6 +134,26 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
   benchmark:
     runs-on: ai-run-linux-gpu
     environment: release
@@ -412,4 +432,7 @@ jobs:
           path: |
             ${{ env.WORKDIR }}/benchmarks/server/server.log
             ${{ env.WORKDIR }}/logs/
-          retention-days: 90
+          retention-days: 90
+    needs:
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true'

.github/workflows/benchmark-llm-llamacpp.yml

@@ -178,6 +178,26 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
   benchmark:
     runs-on: ai-run-linux-gpu
     environment: release
@@ -457,3 +477,6 @@ jobs:
             ${{ inputs.workdir }}/benchmarks/server/server.log
             ${{ inputs.workdir }}/logs/
           retention-days: 90
+    needs:
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true'

.github/workflows/benchmark-ocr-onnx.yml

@@ -31,6 +31,26 @@ permissions:
   contents: read
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
   setup:
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -59,8 +79,10 @@ jobs:
           fi
 
   build:
-    needs: setup
-    if: needs.setup.outputs.qvac_needed == 'true'
+    needs:
+      - setup
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true' && (needs.setup.outputs.qvac_needed == 'true')
     runs-on: ubuntu-24.04
     environment: release
     timeout-minutes: 120
@@ -148,11 +170,12 @@ jobs:
           retention-days: 1
 
   evaluate:
-    needs: [setup, build]
-    if: |
-      always() &&
-      needs.setup.result == 'success' &&
-      (needs.build.result == 'success' || needs.build.result == 'skipped')
+    needs:
+      - setup
+      - build
+      - label-gate
+    if: |-
+      needs.label-gate.outputs.authorised == 'true' && (always() && needs.setup.result == 'success' && (needs.build.result == 'success' || needs.build.result == 'skipped'))
     runs-on: ubuntu-24.04
     environment: release
     timeout-minutes: 180

.github/workflows/benchmark-performance-infer-llm-llamacpp.yml

@@ -43,6 +43,26 @@ permissions:
   id-token: write
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
   context:
     runs-on: ubuntu-latest
     outputs:
@@ -63,7 +83,9 @@ jobs:
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
   prebuild:
-    needs: context
+    needs:
+      - context
+      - label-gate
     permissions:
       contents: write
       packages: write
@@ -75,9 +97,13 @@ jobs:
       repository: ${{ needs.context.outputs.repository }}
       ref: ${{ needs.context.outputs.ref }}
 
+    if: needs.label-gate.outputs.authorised == 'true'
   desktop-benchmarks:
-    needs: [context, prebuild]
-    if: ${{ inputs.run_desktop }}
+    needs:
+      - context
+      - prebuild
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true' && (inputs.run_desktop)
     permissions:
       contents: read
       packages: read
@@ -92,8 +118,11 @@ jobs:
       qvac_perf_only: true
 
   mobile-benchmarks:
-    needs: [context, prebuild]
-    if: ${{ inputs.run_mobile }}
+    needs:
+      - context
+      - prebuild
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true' && (inputs.run_mobile)
     permissions:
       contents: read
       packages: read
@@ -112,8 +141,12 @@ jobs:
     # `if: always()` lets summarize run even when one of the benchmark
     # jobs was skipped via the run_desktop / run_mobile toggles or
     # failed mid-run; we still want the partial report.
-    needs: [context, desktop-benchmarks, mobile-benchmarks]
-    if: ${{ always() && needs.context.result == 'success' }}
+    needs:
+      - context
+      - desktop-benchmarks
+      - mobile-benchmarks
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true' && (always() && needs.context.result == 'success')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/benchmark-performance-transcription-parakeet.yml

@@ -18,6 +18,26 @@ permissions:
   id-token: write
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
   context:
     runs-on: ubuntu-latest
     outputs:
@@ -38,7 +58,9 @@ jobs:
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
   prebuild:
-    needs: context
+    needs:
+      - context
+      - label-gate
     permissions:
       contents: write
       packages: write
@@ -50,8 +72,12 @@ jobs:
       repository: ${{ needs.context.outputs.repository }}
       ref: ${{ needs.context.outputs.ref }}
 
+    if: needs.label-gate.outputs.authorised == 'true'
   desktop-benchmarks:
-    needs: [context, prebuild]
+    needs:
+      - context
+      - prebuild
+      - label-gate
     permissions:
       contents: read
       packages: read
@@ -64,9 +90,13 @@ jobs:
       run_integration_tests: false
       run_rtf_benchmarks: true
 
+    if: needs.label-gate.outputs.authorised == 'true'
   summarize:
-    needs: [context, desktop-benchmarks]
-    if: always()
+    needs:
+      - context
+      - desktop-benchmarks
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true' && (always())
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/benchmark-performance-transcription-whispercpp.yml

@@ -23,6 +23,26 @@ permissions:
   id-token: write
 
 jobs:
+  label-gate:
+    name: Authorise (label-gate)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      authorised: ${{ steps.gate.outputs.authorised }}
+    steps:
+      - name: Checkout (label-gate action only)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github/actions/label-gate
+          sparse-checkout-cone-mode: false
+      - name: Run label-gate
+        id: gate
+        uses: ./.github/actions/label-gate
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
   context:
     runs-on: ubuntu-latest
     outputs:
@@ -46,7 +66,9 @@ jobs:
           echo "include_desktop=${INPUT_INCLUDE_DESKTOP}" >> "$GITHUB_OUTPUT"
 
   prebuild:
-    needs: context
+    needs:
+      - context
+      - label-gate
     permissions:
       contents: write
       packages: write
@@ -58,9 +80,13 @@ jobs:
       repository: ${{ needs.context.outputs.repository }}
       ref: ${{ needs.context.outputs.ref }}
 
+    if: needs.label-gate.outputs.authorised == 'true'
   desktop-benchmarks:
-    needs: [context, prebuild]
-    if: needs.context.outputs.include_desktop != 'false'
+    needs:
+      - context
+      - prebuild
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true' && (needs.context.outputs.include_desktop != 'false')
     permissions:
       contents: read
       packages: read
@@ -73,10 +99,12 @@ jobs:
       run_integration_tests: false
       run_rtf_benchmarks: true
 
-
   summarize:
-    needs: [context, desktop-benchmarks]
-    if: always()
+    needs:
+      - context
+      - desktop-benchmarks
+      - label-gate
+    if: needs.label-gate.outputs.authorised == 'true' && (always())
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -96,7 +124,6 @@ jobs:
           path: benchmark-artifacts/desktop
           merge-multiple: true
 
-
       - name: Generate consolidated benchmark report
         run: |
           node scripts/perf-report/aggregate-whisper-rtf.js \