ci: do not run ci tests by default, require citest comment or label

[richm]

github action ci jobs are a precious resource - we only have 20 jobs - when multiple
PRs are submitted we may have to wait hours to get results. We need to be explicit
about where and when to run ci jobs.

With this change, when a PR is created or updated, CI tests will not run automatically.
A role maintainer (OWNER, MEMBER, COLLABORATOR, or systemroller) must either comment
on the PR or add a label:

• [citest_all] comment or citest_all label - run all CI tests, including checks
  and Testing Farm integration tests
• [citest_$test] comment or citest_$test label - run only that test - for
  example, [citest_ansible-lint] or the citest_ansible-lint label
• For Testing Farm, [citest_tft] / citest_tft runs those tests. [citest] /
  citest is still accepted for Testing Farm for backward compatibility.

Comments work on issue_comment; labels take effect when the PR is opened, when new
commits are pushed, or when the label is added. These labels are managed by
system roles .github automation.

If you use the gh command to interact with github, you can use
gh pr comment $PRNUM -b '[citest_all]'
or
gh pr edit $PRNUM --add-label citest_all

Signed-off-by: Rich Megginson rmeggins@redhat.com

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75112010-bfff-48ab-951d-d8836e7bd495

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[spetrosi]

lgtm, so only act on comments because Labels cannot be implemented due to GitHub limitations?

[richm]

lgtm, so only act on comments because Labels cannot be implemented due to GitHub limitations?

Correct.

I've been looking at the permissions for the label triggers for ci:

1. using github.event.pull_request.author_association is fast, but it only lists the user as a MEMBER or COLLABORATOR if the user is explicitly listed under the repo Collaborators and teams with Direct access - if the user is an organization admin, or is part of the admin team, it says the user is a CONTRIBUTOR - this means we org admins would have to be added to all role repos as having Triage access or higher - for some reason this works differently than the github.event.comment.author_association field

2. using https://docs.github.com/en/rest/collaborators/collaborators?apiVersion=2026-03-10#get-repository-permissions-for-a-user api does give us the right information - but this means every gh action will need to do this search which means a potential for hitting some sort of limit on number of gh api requests in a given time

However, since method 1) is only a problem for org admins, I think it might be worth it to add support for labels for individual repo contributors and admins as a convenience. I'll take a look at this.