feat(ci): add test gating

.github/actions/test-robot-check/action.yml

@@ -0,0 +1,58 @@
+name: "Robot Test Check Labels"
+description: "Fails if test-robot-needed is present but test-robot-done is not."
+
+inputs:
+  label-test-robot-needed:
+    description: 'Label indicating the PR needs robot testing'
+    required: false
+    default: 'test-robot-needed'
+  label-test-robot-done:
+    description: 'Label indicating the PR has been robot-tested'
+    required: false
+    default: 'test-robot-done'
+  token:
+    description: 'GitHub token or PAT used to post comments (defaults to github.token)'
+    required: false
+    default: ''
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check robot test labels
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ inputs.token || github.token }}
+        script: |
+          const labelNeeded = '${{ inputs.label-test-robot-needed }}';
+          const labelDone   = '${{ inputs.label-test-robot-done }}';
+          const { number: pr, head: { sha } } = context.payload.pull_request;
+          const repo = context.repo;
+
+          const postComment = async (body) => {
+            try {
+              await github.rest.issues.createComment({ ...repo, issue_number: pr, body });
+            } catch (err) {
+              core.warning(`Could not post comment: ${err.message}`);
+            }
+          };
+
+          const { data: labels } = await github.rest.issues.listLabelsOnIssue({ ...repo, issue_number: pr });
+          const has = new Set(labels.map(l => l.name));
+
+          if (!has.has(labelNeeded)) {
+            core.info(`\`${labelNeeded}\` not present — no robot testing required.`);
+            return;
+          }
+
+          if (has.has(labelDone)) {
+            core.info(`\`${labelDone}\` present — robot testing confirmed.`);
+            return;
+          }
+
+          const shaLine = sha ? `\n\n**Commit:** \`${sha}\`` : '';
+          await postComment(
+            `### ❌ Robot Testing Required\n\n` +
+            `\`${labelNeeded}\` is present but \`${labelDone}\` has not been added. This PR cannot be merged until robot testing is complete.${shaLine}\n\n` +
+            `> [!IMPORTANT]\n> Add \`${labelDone}\` once robot testing is complete.`
+          );
+          core.setFailed(`\`${labelNeeded}\` is present but \`${labelDone}\` has not been added — robot testing must be completed before merging.`);

.github/actions/test-robot-label/action.yml

@@ -0,0 +1,61 @@
+name: "Robot Test Label"
+description: "When the test-robot-done label is added, posts a comment confirming the robot test status."
+
+inputs:
+  label-test-robot-needed:
+    description: 'Label indicating the PR needs robot testing'
+    required: false
+    default: 'test-robot-needed'
+  label-test-robot-done:
+    description: 'Label indicating the PR has been robot-tested'
+    required: false
+    default: 'test-robot-done'
+  token:
+    description: 'GitHub token or PAT used to post comments (defaults to github.token)'
+    required: false
+    default: ''
+
+runs:
+  using: "composite"
+  steps:
+    - name: Comment on label added
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ inputs.token || github.token }}
+        script: |
+          const labelDone   = '${{ inputs.label-test-robot-done }}';
+          const labelNeeded = '${{ inputs.label-test-robot-needed }}';
+          const { number: pr, head: { sha } } = context.payload.pull_request;
+          const repo = context.repo;
+
+          const postComment = async (body) => {
+            try {
+              await github.rest.issues.createComment({ ...repo, issue_number: pr, body });
+            } catch (err) {
+              core.warning(`Could not post comment: ${err.message}`);
+            }
+          };
+
+          const { data: labels } = await github.rest.issues.listLabelsOnIssue({ ...repo, issue_number: pr });
+          const has = new Set(labels.map(l => l.name));
+          const shaLine = sha ? `\n\n**Commit:** \`${sha}\`` : '';
+
+          if (!has.has(labelDone)) {
+            if (has.has(labelNeeded)) {
+              core.warning(`\`${labelDone}\` not found — \`${labelNeeded}\` is present but testing is not confirmed.`);
+              await postComment(
+                `### ⚠️ Robot Testing Incomplete\n\n` +
+                `\`${labelNeeded}\` is present but \`${labelDone}\` has not been added yet.${shaLine}\n\n` +
+                `> [!WARNING]\n> Add \`${labelDone}\` once robot testing is complete.`
+              );
+            } else {
+              core.info(`\`${labelDone}\` not present — nothing to do.`);
+            }
+            return;
+          }
+
+          core.info(`\`${labelDone}\` found — posting confirmation comment.`);
+          await postComment(
+            `### ✅ Robot Test Complete\n\n` +
+            `\`${labelDone}\` has been added — robot testing has been confirmed for this PR.${shaLine}`
+          );

.github/actions/test-robot-unlabel/action.yml

@@ -0,0 +1,58 @@
+name: "Robot Test Unlabel"
+description: "On new commits, removes the test-robot-done label if present and posts a comment."
+
+inputs:
+  label-test-robot-needed:
+    description: 'Label indicating the PR needs robot testing'
+    required: false
+    default: 'test-robot-needed'
+  label-test-robot-done:
+    description: 'Label indicating the PR has been robot-tested'
+    required: false
+    default: 'test-robot-done'
+  token:
+    description: 'GitHub token or PAT used to remove labels and post comments (defaults to github.token)'
+    required: false
+    default: ''
+
+runs:
+  using: "composite"
+  steps:
+    - name: Remove label and comment
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ inputs.token || github.token }}
+        script: |
+          const labelDone   = '${{ inputs.label-test-robot-done }}';
+          const labelNeeded = '${{ inputs.label-test-robot-needed }}';
+          const { number: pr, head: { sha } } = context.payload.pull_request;
+          const repo = context.repo;
+
+          const postComment = async (body) => {
+            try {
+              await github.rest.issues.createComment({ ...repo, issue_number: pr, body });
+            } catch (err) {
+              core.warning(`Could not post comment: ${err.message}`);
+            }
+          };
+
+          const { data: labels } = await github.rest.issues.listLabelsOnIssue({ ...repo, issue_number: pr });
+          const has = new Set(labels.map(l => l.name));
+
+          if (!has.has(labelDone)) {
+            core.info(`\`${labelDone}\` not present — nothing to do.`);
+            return;
+          }
+
+          await github.rest.issues.removeLabel({ ...repo, issue_number: pr, name: labelDone });
+          core.info(`\`${labelDone}\` removed.`);
+
+          const shaLine = sha ? `\n\n**Commit:** \`${sha}\`` : '';
+          const warning = !has.has(labelNeeded)
+            ? `\n\n> [!WARNING]\n> \`${labelDone}\` was removed but \`${labelNeeded}\` was not present — this PR may not be queued for robot testing.`
+            : '';
+
+          await postComment(
+            `### 🔄 Robot Test Label Removed\n\n` +
+            `New commits were pushed. \`${labelDone}\` has been removed and robot testing must be repeated.${shaLine}${warning}`
+          );

.github/workflows/all-green.yml

@@ -0,0 +1,14 @@
+name: All Green
+
+on:
+  workflow_call:
+
+jobs:
+  all-green:
+    name: All Green
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: All Green
+        uses: getdevopspro/github-actions/all-green@v6.1.1

.github/workflows/build.yaml → .github/workflows/build.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   build:
     name: Build
-    uses: getdevopspro/github-actions/.github/workflows/build.yml@v6.0.4
+    uses: getdevopspro/github-actions/.github/workflows/build.yml@v6.1.1
     with:
       version-package: package.json
       version-package-lock: package-lock.json

.github/workflows/pull-request-label.yml

@@ -0,0 +1,24 @@
+name: PR - Label
+
+on:
+  pull_request:
+    types: [labeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: write
+
+jobs:
+  test-robot-label:
+    name: Job
+    uses: ./.github/workflows/test-robot-label.yml
+    with:
+      label-test-robot-done: test-robot-done
+      label-test-robot-needed: test-robot-needed
+    secrets:
+      token: ${{ secrets.BOT_PR_TOKEN }}

.github/workflows/pull-request.yml

@@ -11,8 +11,34 @@ concurrency:
 permissions:
   contents: read
   packages: write
+  pull-requests: write
 
 jobs:
+  test-robot-unlabel:
+    if: github.event.action == 'synchronize'
+    name: Job
+    uses: ./.github/workflows/test-robot-unlabel.yml
+    with:
+      label-test-robot-done: test-robot-done
+      label-test-robot-needed: test-robot-needed
+    secrets:
+      token: ${{ secrets.BOT_PR_TOKEN }}
+
   build:
+    needs: test-robot-unlabel
+    if: ${{ !failure() && !cancelled() && needs.test-robot-unlabel.result != 'failure' }}
+    name: Job
+    uses: ./.github/workflows/build.yml
+
+  test-robot-check:
+    needs: build
+    name: Job
+    uses: ./.github/workflows/test-robot-check.yml
+    with:
+      label-test-robot-done: test-robot-done
+      label-test-robot-needed: test-robot-needed
+
+  all-green:
+    needs: test-robot-check
     name: Job
-    uses: ./.github/workflows/build.yaml
+    uses: ./.github/workflows/all-green.yml

.github/workflows/release.yml

@@ -19,12 +19,12 @@ permissions:
 jobs:
   build:
     name: Job
-    uses: ./.github/workflows/build.yaml
+    uses: ./.github/workflows/build.yml
 
   promote:
     name: Job
     needs: build
-    uses: getdevopspro/github-actions/.github/workflows/promote.yml@v6.0.4
+    uses: getdevopspro/github-actions/.github/workflows/promote.yml@v6.1.1
     secrets:
       # To bypass ruleset enforcing checks
       checkout-token: ${{ secrets.BOT_RELEASE_CHECKOUT_TOKEN }}

.github/workflows/test-robot-check.yml

@@ -0,0 +1,38 @@
+name: Robot Test Check
+
+on:
+  workflow_call:
+    inputs:
+      label-test-robot-done:
+        description: 'Label name indicating the PR has been test-robot-done'
+        type: string
+        required: false
+        default: 'test-robot-done'
+      label-test-robot-needed:
+        description: 'Label name indicating the PR needs robot testing'
+        type: string
+        required: false
+        default: 'test-robot-needed'
+    secrets:
+      token:
+        description: 'PAT used to post comments'
+        required: false
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  test-robot-check-labels:
+    if: contains(github.event.pull_request.labels.*.name, inputs.label-test-robot-needed) || github.run_attempt > 1
+    name: Robot Test Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Robot Test Check
+        uses: ./.github/actions/test-robot-check
+        with:
+          label-test-robot-done: ${{ inputs.label-test-robot-done }}
+          label-test-robot-needed: ${{ inputs.label-test-robot-needed }}
+          token: ${{ secrets.token }}

.github/workflows/test-robot-label.yml

@@ -0,0 +1,46 @@
+name: Robot Test Label
+
+on:
+  workflow_call:
+    inputs:
+      label-test-robot-done:
+        description: 'Label name indicating the PR has been test-robot-done'
+        type: string
+        required: false
+        default: 'test-robot-done'
+      label-test-robot-needed:
+        description: 'Label name indicating the PR needs robot testing'
+        type: string
+        required: false
+        default: 'test-robot-needed'
+    secrets:
+      token:
+        description: 'PAT used to post comments'
+        required: false
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: write
+
+jobs:
+  test-robot-label:
+    if: github.event.action == 'labeled' &&
+      github.event.label.name == inputs['label-test-robot-done']
+    name: Robot Test Label
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Robot Test Label
+        uses: ./.github/actions/test-robot-label
+        with:
+          label-test-robot-done: ${{ inputs.label-test-robot-done }}
+          label-test-robot-needed: ${{ inputs.label-test-robot-needed }}
+          token: ${{ secrets.token }}
+
+      - name: Rerun pull-request workflow
+        uses: getdevopspro/github-actions/pr/checks-rerun@v6.1.1
+        with:
+          workflow-id: pull-request.yml
+          github-token: ${{ secrets.token }}