Limit CI to authorized PRs only

Author: gtopper

.github/workflows/pr.yaml

@@ -20,10 +20,22 @@ on:
       - development
       - 'integ_[0-9]+\.[0-9]+'
 
+permissions:
+  contents: read
+
 jobs:
+  fail-if-unsafe:
+    runs-on: ubuntu-latest
+    if: ${{ !contains( github.event.pull_request.labels.*.name, 'safe-to-test') }}
+    steps:
+      - name: Fail if not marked as safe to test
+        run: |
+          echo "CI will not run on a PR unless it has the safe-to-test label applied"
+          exit 1
   test-go:
     name: Lint & test Go code
     runs-on: [ self-hosted, Linux ]
+    if: ${{ contains( github.event.pull_request.labels.*.name, 'safe-to-test') }}
     container:
       image: golang:1.24-alpine
 
@@ -61,6 +73,7 @@ jobs:
   test-py:
     name: Lint & test Python code
     runs-on: [ self-hosted, Linux ]
+    if: ${{ contains( github.event.pull_request.labels.*.name, 'safe-to-test') }}
     container:
       image: python:3.9.18