Gate PR Builder on the trigger-pr-builder label as a temporary workaround

[DonOmalVindula]

Purpose

Note: This is a temporary workaround for the current CI runner saturation, to be reverted once queue pressure is resolved (tracked in #4268).

Every push to a PR currently runs the full PR Builder (~15 jobs), but during early review iteration devs are mostly addressing CodeRabbit/Copilot comments, so those runs are wasted and they saturate the shared runner pool for everyone. This gates the PR Builder on a trigger-pr-builder label: devs iterate freely without consuming runners, then add the label when the PR is ready, which runs CI for that push and every subsequent one.

Part of the queue-pressure work in #4268.

Approach

Built directly on main as a single commit, independent of #4269. labeled is added to the pull_request trigger types, and each root job's condition requires the trigger-pr-builder label on pull_request events. merge_group and workflow_dispatch behavior is unchanged, so the merge queue still fully validates every PR regardless of labels. Downstream jobs cascade off their needs and skip automatically on unlabeled runs; the two always() jobs and the detect-* jobs get the same label check so unlabeled pushes consume zero runners. (The build/test jobs are gated directly rather than relying on detect-code-changes skipping, because their existing condition treats a skipped detect job as a green light.)

The label is sticky: once added, later pushes run CI normally. Unlabeled runs report their jobs as skipped, and the codecov/patch status stays at "Expected" until CI actually runs, so an unlabeled PR cannot enter the merge queue with skipped checks.

Known limitation, deferred on purpose: adding any label to an already-labeled PR re-triggers the workflow, which restarts CI (and cancels an in-flight run via the concurrency group). Refinements for that (no-op concurrency group for unrelated label events) were prototyped and can be added later if it becomes annoying in practice.

The trigger-pr-builder label has been created in the repo.

Related Issues

• Refs Reduce PR Builder and merge queue turnaround time #4268

Related PRs

• Speed up PR builder with pnpm/turbo caching, job consolidation, and parallel E2E workers #4269 touches the same file for other CI speedups; whichever merges second needs a trivial rebase.

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• Chores
  • Pull request validation workflows now run only when the trigger-pr-builder label is present.
  • Adding or updating the label can initiate the relevant checks.
  • Builds, tests, security scans, linting, documentation validation, and Windows validation now follow the same label-based conditions.
  • Merge queue and manually triggered workflows continue to follow their existing behavior.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR builder workflow now responds to trigger-pr-builder label events and gates pull-request CI jobs on that label, while preserving merge queue and manual execution paths.

Changes

Pull-request CI gating

Layer / File(s)	Summary
Label-triggered core checks .github/workflows/pr-builder.yml	The workflow accepts label events, and security, dependency, mock, and lint checks require the trigger-pr-builder label on pull requests.
Build and test job gating .github/workflows/pr-builder.yml	Code detection is label-gated and reports code=true; build, frontend tests, samples, and integration status use the corresponding label condition.
Specialized validation and cleanup .github/workflows/pr-builder.yml	PowerShell and documentation detection plus Turbo cache cleanup require the label for pull-request runs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• thunder-id/thunderid#4181: Both update CI behavior for mock verification and lint jobs.
• thunder-id/thunderid#4269: Both modify conditional execution around PR builder change detection.

Suggested reviewers: malith-19, madurangasiriwardena, brionmario

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: gating the PR Builder workflow on the trigger-pr-builder label as a temporary workaround.
Description check	✅ Passed	The description follows the required template and includes purpose, approach, related issues/PRs, checklist, and security checks.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/pr-builder.yml (1)

509-538: 🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win

test-integration's if doesn't check build_samples result.

needs includes build_samples, but if: ${{ always() && needs.build.result == 'success' }} (line 538, unchanged) never checks needs.build_samples.result. If build_samples fails while build succeeds, test-integration's 3-way matrix still runs — wasting runner time, contrary to this PR's stated goal. test-e2e (line 666) correctly checks both.

♻️ Proposed fix

-    if: ${{ always() && needs.build.result == 'success' }}
+    if: ${{ always() && needs.build.result == 'success' && needs.build_samples.result == 'success' }}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-builder.yml around lines 509 - 538, Update the
test-integration job’s if condition to require both needs.build.result and
needs.build_samples.result to equal success, while preserving always() and the
existing matrix execution behavior. Use the existing build and build_samples
dependency names in the condition.

🧹 Nitpick comments (1)

.github/workflows/pr-builder.yml (1)

33-153: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Repeated label-gating boolean is duplicated across ~10 jobs.

The same contains(github.event.pull_request.labels.*.name, 'trigger-pr-builder') && (github.event.action != 'labeled' || ...) expression (with subtly inconsistent workflow_dispatch handling, as flagged above) is copy-pasted across preflight, verify-mocks, lint, build, test-frontend-packages, test-frontend-gate-app, test-frontend-console-app, build_samples, test-integration-status, and cleanup-turbo-cache. Computing this once (e.g., as a preflight output, similar to docs-changed/powershell-changed) and having downstream jobs check that single output would eliminate this class of drift.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-builder.yml around lines 33 - 153, Consolidate the
repeated trigger-pr-builder label and event gating used by preflight,
verify-mocks, lint, build, test-frontend-packages, test-frontend-gate-app,
test-frontend-console-app, build_samples, test-integration-status, and
cleanup-turbo-cache into one shared preflight output, including the intended
workflow_dispatch handling. Define the boolean once in preflight alongside
docs-changed and powershell-changed, then have each downstream job gate on that
output while preserving merge_group behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-builder.yml:
- Around line 150-152: Update the lint job’s if condition to include
github.event_name == 'workflow_dispatch' as an unconditional execution path,
alongside the existing pull_request and merge_group conditions, so manual
dispatch runs execute backend/frontend lint.
- Around line 114-116: Update the verify-mocks job condition to include
workflow_dispatch alongside pull_request and merge_group, matching the preflight
condition so manual dispatch runs execute mock verification.
- Around line 37-39: Update the preflight job’s if condition to allow
github.event_name == 'workflow_dispatch' unconditionally, alongside the existing
pull_request label-gated and merge_group branches. Preserve the current pull
request label and action checks for pull_request events.

---

Outside diff comments:
In @.github/workflows/pr-builder.yml:
- Around line 509-538: Update the test-integration job’s if condition to require
both needs.build.result and needs.build_samples.result to equal success, while
preserving always() and the existing matrix execution behavior. Use the existing
build and build_samples dependency names in the condition.

---

Nitpick comments:
In @.github/workflows/pr-builder.yml:
- Around line 33-153: Consolidate the repeated trigger-pr-builder label and
event gating used by preflight, verify-mocks, lint, build,
test-frontend-packages, test-frontend-gate-app, test-frontend-console-app,
build_samples, test-integration-status, and cleanup-turbo-cache into one shared
preflight output, including the intended workflow_dispatch handling. Define the
boolean once in preflight alongside docs-changed and powershell-changed, then
have each downstream job gate on that output while preserving merge_group
behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: df693a54-c588-49ca-9796-e3835c2adff2

📥 Commits

Reviewing files that changed from the base of the PR and between 99130c3 and df5c40d.

📒 Files selected for processing (4)

• .github/actions/setup-pnpm/action.yml
• .github/workflows/pr-builder.yml
• tests/e2e/package.json
• tests/e2e/playwright.config.ts

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-builder.yml:
- Line 35: Update the job conditions for security-audit, dependency-review,
verify-mocks, and lint in .github/workflows/pr-builder.yml at lines 35-35,
56-56, 100-100, and 136-136 to allow workflow_dispatch runs unconditionally by
adding the github.event_name == 'workflow_dispatch' branch alongside the
existing pull-request and merge-group conditions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3d522020-56cc-40f6-a767-8f1d6e0d5217

📥 Commits

Reviewing files that changed from the base of the PR and between 631cef2 and d063e28.

📒 Files selected for processing (1)

• .github/workflows/pr-builder.yml