[PM-33888] ci: Run label enforcement from the labeler workflow (#7485)

.github/workflows/sdlc-enforce-labels.yml

@@ -1,10 +1,7 @@
 name: SDLC / Enforce PR labels
-run-name: Enforce labels for PR ${{ github.event.pull_request.number || inputs.pr-number }}
 
 on:
-  pull_request:
-    types: [labeled, unlabeled, edited, opened, reopened, synchronize]
-  workflow_dispatch:
+  workflow_call:
     inputs:
       pr-number:
         description: "Pull Request Number"
@@ -14,11 +11,11 @@ on:
 permissions: {}
 
 env:
-  _PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr-number }}
+  _PR_NUMBER: ${{ inputs.pr-number }}
 
 jobs:
   enforce-label:
-    name: Enforce Label
+    name: Enforce
     runs-on: ubuntu-24.04
     permissions:
       pull-requests: read

.github/workflows/sdlc-label-pr.yml

@@ -1,14 +1,18 @@
-name: SDLC / Label PR
+name: SDLC / Labeler
 run-name: Label PR ${{ github.event.pull_request.number || inputs.pr-number }}${{ github.event_name == 'workflow_dispatch' && format(' / mode "{0}" dry-run "{1}"', inputs.mode, inputs.dry-run) || '' }}
 on:
   pull_request:
-    types: [opened, synchronize]
+    types: [opened, reopened, synchronize, labeled, unlabeled, edited]
   workflow_dispatch:
     inputs:
       pr-number:
         description: "Pull Request Number"
         required: true
         type: number
+      label-pr:
+        description: "Label PR - Run the labeler job (otherwise only enforce labels)"
+        type: boolean
+        default: true
       mode:
         description: "Labeling Mode"
         type: choice
@@ -27,11 +31,12 @@ env:
 jobs:
   label-pr:
     name: Label PR by Changed Files
+    # only auto-label when PR is opened or new commits are pushed
+    if: ${{ inputs.label-pr || contains(fromJSON('["opened","reopened","synchronize"]'), github.event.action) }}
     runs-on: ubuntu-24.04
     permissions:
       pull-requests: write # required to update labels
       contents: read
-      actions: write # required to trigger sdlc-enforce-labels.yml
 
     steps:
       - name: Check out repository
@@ -89,23 +94,13 @@ jobs:
           echo ""
           python3 .github/scripts/label-pr.py "$_PR_NUMBER" "$_PR_LABELS" "$_LABEL_MODE" "$_DRY_RUN"
 
-      - name: Trigger label enforcement
-        if: ${{ !inputs.dry-run }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          _HEAD_REF: ${{ github.event.pull_request.head.ref }}
-          _IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
-        run: |
-          # Support workflow_dispatch testing by retrieving PR data
-          if [ -z "$_HEAD_REF" ]; then
-            echo "👀 Head ref is empty, retrieving PR data for PR #$_PR_NUMBER..."
-            PR_DATA=$(gh pr view "$_PR_NUMBER" --json headRefName,isCrossRepository)
-            _HEAD_REF=$(echo "$PR_DATA" | jq -r '.headRefName')
-            _IS_FORK=$(echo "$PR_DATA" | jq -r '.isCrossRepository')
-          fi
-          if [ "$_IS_FORK" = "true" ]; then
-            echo "⏭️ Fork PR. Label enforcement runs on the pull_request event instead."
-            exit 0
-          fi
-          # Dispatch on the PR head branch so the check attaches to the PR head SHA
-          gh workflow run sdlc-enforce-labels.yml --ref "$_HEAD_REF" -f pr-number="$_PR_NUMBER"
+  enforce-labels:
+    name: Enforce PR labels
+    # label-pr is skipped on label events, so !cancelled() lets this job run after a skipped job
+    needs: label-pr
+    if: ${{ !cancelled() && !inputs.dry-run }}
+    permissions:
+      pull-requests: read
+    uses: ./.github/workflows/sdlc-enforce-labels.yml
+    with:
+      pr-number: ${{ github.event.pull_request.number || inputs.pr-number }}