CI: adding the ci-allow label does not re-trigger CI on a fork PR #509

Problem

Two manual steps are currently needed to get CI running on an outside contributor's PR (seen on #491):

1. Labeling ci-allow does nothing on its own. .github/workflows/ci.yml uses on: pull_request without types:, which fires only on opened/synchronize/reopened — not on labeled. After adding the label someone must gh run rerun the latest run (this works only because check-actor fetches labels live via the API) or the author must push again.
2. Every new push from the fork lands as action_required and needs a one-off approval before the run starts (gh api -X POST repos/crazy-goat/rabbit-stream/actions/runs/<id>/approve).

Proposal

Add labeled to the trigger types and gate the jobs so only the ci-allow label spins up the pipeline:

on:
  pull_request:
    branches: ["main"]
    types: [opened, synchronize, reopened, labeled]

plus a job-level guard (on top of the existing check-actor gate):

if: github.event.action != 'labeled' || github.event.label.name == 'ci-allow'

Caveat

Per the comment at the top of ci.yml: every name: must stay byte-identical to the branch protection required status check contexts (lint, unit-tests (PHP 8.1) … unit-tests (PHP 8.4), e2e-tests) — do not rename jobs in the same change.

Acceptance criteria

• Adding ci-allow to a fork PR triggers CI without a manual gh run rerun