pr-label-cleanup.yml

# Auto-remove run-ci label when new commits are pushed to external PRs
# This ensures maintainers must re-approve after code changes

name: PR Label Cleanup

on:
  pull_request:
    types: [synchronize]  # New commits pushed

permissions:
  pull-requests: write

jobs:
  remove-label:
    # Only run if PR has run-ci label and author is external
    if: contains(github.event.pull_request.labels.*.name, 'run-ci')
    runs-on: ubuntu-latest
    steps:
      - name: Check if external contributor
        id: check
        run: |
          ASSOC="${{ github.event.pull_request.author_association }}"
          if [[ "$ASSOC" =~ ^(OWNER|MEMBER|COLLABORATOR)$ ]]; then
            echo "is_external=false" >> "$GITHUB_OUTPUT"
            echo "PR author has $ASSOC access, keeping label"
          else
            echo "is_external=true" >> "$GITHUB_OUTPUT"
            echo "PR author is $ASSOC (external), will remove label"
          fi

      - name: Remove run-ci label
        if: steps.check.outputs.is_external == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Removing run-ci label from PR #${{ github.event.pull_request.number }}"
          gh pr edit ${{ github.event.pull_request.number }} \
            --repo ${{ github.repository }} \
            --remove-label "run-ci"

          # Post a comment explaining why
          gh pr comment ${{ github.event.pull_request.number }} \
            --repo ${{ github.repository }} \
            --body "New commits detected. The \`run-ci\` label has been removed for security.

          A maintainer can re-approve by commenting \`@flashinfer-bot run\`"