Add Workflow label verification for CI (#8653)

* Add labeler

* Update verify with comment

* Add label verification

* Add label verification

* Update .github/teams.yml

.github/teams.yml

@@ -0,0 +1,56 @@
+# Add here any member that should belong to either a specific team,
+# or that can have the tests automatically validated to run safely.
+
+"safe to test":
+  - '@ayush-shah'
+  - '@MilanBariya'
+  - '@nahuelverdugo'
+  - '@NiharDoshi99'
+  - '@OnkarVO7'
+  - '@TeddyCr'
+  - '@ulixius9'
+  - '@pmbrull'
+  - '@aniketkatkar97'
+  - '@Ashish8689'
+  - '@chirag-madlani'
+  - '@Sachin-chaurasiya'
+  - '@shahsank3t'
+  - '@ShaileshParmar11'
+  - '@harshach'
+  - '@mohityadav766'
+  - '@sureshms'
+  - '@akash-jain-10'
+  - '@Vj-L'
+  - '@ShilpaVernekar'
+  - '@snyk-bot'
+  - '@dependabot'
+
+ingestion:
+  - '@ayush-shah'
+  - '@MilanBariya'
+  - '@nahuelverdugo'
+  - '@NiharDoshi99'
+  - '@OnkarVO7'
+  - '@TeddyCr'
+  - '@ulixius9'
+  - '@pmbrull'
+
+UI:
+  - '@aniketkatkar97'
+  - '@Ashish8689'
+  - '@chirag-madlani'
+  - '@Sachin-chaurasiya'
+  - '@shahsank3t'
+  - '@ShaileshParmar11'
+
+backend:
+  - '@harshach'
+  - '@mohityadav766'
+  - '@sureshms'
+
+devops:
+  - '@akash-jain-10'
+  - '@Vj-L'
+
+documentation:
+  - '@ShilpaVernekar'

.github/workflows/airflow-apis-tests-3_9.yml

@@ -34,6 +34,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
+    - name: Wait for the labeler
+      uses: lewagon/wait-on-check-action@v1.2.0
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        check-name: Team Label
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        wait-interval: 30
+
+    - name: Verify PR labels
+      uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+      with:
+        github-token: '${{ secrets.GITHUB_TOKEN }}'
+        valid-labels: 'safe to test'
+        pull-request-number: '${{ github.event.pull_request.number }}'
+        disable-reviews: true  # To not auto approve changes
+
     - name: Checkout
       uses: actions/checkout@v2
       with:

.github/workflows/approval.yml

@@ -1,13 +0,0 @@
-name: Get Approval
-
-on:
-  pull_request:
-
-jobs:
-  approval:
-    name: Approval
-    runs-on: ubuntu-latest
-    steps:
-      - name: Echo
-        run: |
-          echo "PRs from external contributors require an approval from the OpenMetadata team."

.github/workflows/cypress-integration-tests-mysql.yml

@@ -42,6 +42,22 @@ jobs:
     environment: cypress
     steps:
 
+      - name: Wait for the labeler
+        uses: lewagon/wait-on-check-action@v1.2.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          check-name: Team Label
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
+
+      - name: Verify PR labels
+        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'safe to test'
+          pull-request-number: '${{ github.event.pull_request.number }}'
+          disable-reviews: true  # To not auto approve changes
+
       - name: Checkout
         uses: actions/checkout@v2
         with:

.github/workflows/cypress-integration-tests-postgresql.yml

@@ -42,6 +42,22 @@ jobs:
     environment: cypress
     steps:
 
+      - name: Wait for the labeler
+        uses: lewagon/wait-on-check-action@v1.2.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          check-name: Team Label
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
+
+      - name: Verify PR labels
+        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'safe to test'
+          pull-request-number: '${{ github.event.pull_request.number }}'
+          disable-reviews: true  # To not auto approve changes
+
       - name: Checkout
         uses: actions/checkout@v2
         with:

.github/workflows/java-checkstyle.yml

@@ -30,6 +30,23 @@ jobs:
       pull-requests: write
 
     steps:
+
+      - name: Wait for the labeler
+        uses: lewagon/wait-on-check-action@v1.2.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          check-name: Team Label
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
+
+      - name: Verify PR labels
+        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'safe to test'
+          pull-request-number: '${{ github.event.pull_request.number }}'
+          disable-reviews: true  # To not auto approve changes
+
       - name: Checkout
         uses: actions/checkout@v2
         with:

.github/workflows/maven-build.yml

@@ -20,6 +20,7 @@ on:
       - "openmetadata-service/**"
       - "openmetadata-ui/**"
   pull_request_target:
+    types: [labeled, opened, synchronize, reopened]
     branches:
       - main
       - '0.[0-9]+.[0-9]+'
@@ -47,6 +48,22 @@ jobs:
 
     steps:
 
+      - name: Wait for the labeler
+        uses: lewagon/wait-on-check-action@v1.2.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          check-name: Team Label
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
+
+      - name: Verify PR labels
+        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'safe to test'
+          pull-request-number: '${{ github.event.pull_request.number }}'
+          disable-reviews: true  # To not auto approve changes
+
       - name: install libssl
         run: |
          sudo su -c "echo 'deb http://security.ubuntu.com/ubuntu xenial-security main' >> /etc/apt/sources.list"

.github/workflows/py-checkstyle.yml

@@ -15,6 +15,7 @@ name: Python Checkstyle
 # access to secrets
 on:
   pull_request_target:
+    types: [labeled, opened, synchronize, reopened]
     branches:
       - main
       - '0.[0-9]+.[0-9]+'
@@ -33,6 +34,23 @@ jobs:
       pull-requests: write
 
     steps:
+
+      - name: Wait for the labeler
+        uses: lewagon/wait-on-check-action@v1.2.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          check-name: Team Label
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
+
+      - name: Verify PR labels
+        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'safe to test'
+          pull-request-number: '${{ github.event.pull_request.number }}'
+          disable-reviews: true  # To not auto approve changes
+
       - name: Checkout
         uses: actions/checkout@v2
         with:

.github/workflows/py-tests.yml

@@ -19,6 +19,7 @@ on:
       - ingestion/**
       - openmetadata-service/**
   pull_request_target:
+    types: [labeled, opened, synchronize, reopened]
     branches:
       - main
       - '0.[0-9]+.[0-9]+'
@@ -37,6 +38,22 @@ jobs:
         py-version: ['3.7', '3.8', '3.9']
     steps:
 
+    - name: Wait for the labeler
+      uses: lewagon/wait-on-check-action@v1.2.0
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        check-name: Team Label
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        wait-interval: 30
+
+    - name: Verify PR labels
+      uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+      with:
+        github-token: '${{ secrets.GITHUB_TOKEN }}'
+        valid-labels: 'safe to test'
+        pull-request-number: '${{ github.event.pull_request.number }}'
+        disable-reviews: true  # To not auto approve changes
+
     - name: Checkout
       uses: actions/checkout@v2
       with:

.github/workflows/team-labeler.yml

@@ -0,0 +1,39 @@
+on:
+  pull_request_target:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+name: Team Label
+jobs:
+  labeler:
+    runs-on: ubuntu-latest
+    name: Team Label
+    steps:
+      - uses: JulienKode/team-labeler-action@v0.1.1
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Verify PR labels
+        id: verify
+        continue-on-error: true
+        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'safe to test'
+          pull-request-number: '${{ github.event.pull_request.number }}'
+          disable-reviews: true  # To not auto approve changes
+
+      - name: Add verification comment
+        if: steps.verify.outcome != 'success'
+        uses: peter-evans/create-or-update-comment@v1
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            **Hi there 👋 Thanks for your contribution!**
+            
+            The OpenMetadata team will review the PR shortly! Once it has been labeled as `safe to test`, the CI workflows
+            will start executing and we'll be able to make sure everything is working as expected.
+            
+            Let us know if you need any help!

.github/workflows/yarn-coverage.yml

@@ -30,6 +30,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
+    - name: Wait for the labeler
+      uses: lewagon/wait-on-check-action@v1.2.0
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        check-name: Team Label
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        wait-interval: 30
+
+    - name: Verify PR labels
+      uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+      with:
+        github-token: '${{ secrets.GITHUB_TOKEN }}'
+        valid-labels: 'safe to test'
+        pull-request-number: '${{ github.event.pull_request.number }}'
+        disable-reviews: true  # To not auto approve changes
+
     - uses: actions/checkout@v2
       with:
         ref: ${{ github.event.pull_request.head.sha }}