test(e2e): allow external PRs via ok-to-test label

Add ok-to-test label gating as a fallback for external contributors
who are not org members or repo collaborators. Maintainers can
approve external PRs by adding the ok-to-test label after code
review.

The label is automatically removed on synchronize, opened, and
reopened events to prevent running CI on new untrusted code without
re-approval.

Signed-off-by: Zaki Shaikh <zashaikh@redhat.com>
Assisted-by: Claude Opus 4.6 (via Claude Code)

Author: zakisk

.github/workflows/e2e.yaml

@@ -19,6 +19,7 @@ on:
       - opened
       - reopened
       - synchronize
+      - labeled
     paths:
       - "**.go"
       - ".github/workflows/**"
@@ -32,7 +33,8 @@ jobs:
     if: >
       github.event_name == 'schedule' ||
       github.event_name == 'workflow_dispatch' ||
-      github.event_name == 'pull_request_target'
+      (github.event_name == 'pull_request_target' && github.event.action != 'labeled') ||
+      (github.event_name == 'pull_request_target' && github.event.action == 'labeled' && github.event.label.name == 'ok-to-test')
     concurrency:
       group: ${{ github.workflow }}-${{ matrix.provider }}-${{ github.event.pull_request.number || github.ref_name }}
       cancel-in-progress: true
@@ -136,6 +138,27 @@ jobs:
               core.info(`📋 Repository: ${repoOwner}/${repoName}`);
               core.info(`🏢 Target organization: ${targetOrg}`);
 
+              // Security: On non-labeled events (opened, reopened, synchronize),
+              // remove the ok-to-test label if present. This prevents an external
+              // contributor from pushing malicious code after a maintainer approved via label.
+              if (context.payload.action !== 'labeled') {
+                const currentLabels = context.payload.pull_request.labels.map(l => l.name);
+                if (currentLabels.includes('ok-to-test')) {
+                  core.info(`🔒 Removing ok-to-test label due to '${context.payload.action}' event — re-approval required.`);
+                  try {
+                    await github.rest.issues.removeLabel({
+                      owner: repoOwner,
+                      repo: repoName,
+                      issue_number: context.payload.pull_request.number,
+                      name: 'ok-to-test',
+                    });
+                    core.info(`   Label removed successfully.`);
+                  } catch (err) {
+                    core.warning(`   Failed to remove ok-to-test label: ${err.message}`);
+                  }
+                }
+              }
+
               // Condition 1: Check if the user is a trusted bot.
               const trustedBots = ["dependabot[bot]", "renovate[bot]"];
               core.info(`🤖 Checking if @${actor} is a trusted bot...`);
@@ -256,21 +279,24 @@ jobs:
                   );
                   return; // Success
                 } else {
-                  // If we reach here, no conditions were met. This is the final failure.
                   core.info(`   ❌ Permission '${permission}' is insufficient (requires 'write' or 'admin')`);
-                  core.setFailed(
-                    `❌ Permission check failed. User @${actor} did not meet any required conditions (trusted bot, org member, or repo write access).`,
-                  );
-                  return;
                 }
               } catch (error) {
-                // This error means they are not even a collaborator.
                 core.info(`   ❌ Collaborator permission check failed: ${error.message}`);
-                core.setFailed(
-                  `❌ Permission check failed. User @${actor} is not a collaborator on this repository and did not meet other conditions.`,
-                );
-                return;
               }
+
+              // Condition 4: Check for ok-to-test label (for external contributors approved by maintainers).
+              // Only users with repo write access can add labels, so this is inherently gated.
+              core.info(`\n🏷️ Condition 4: Checking for ok-to-test label...`);
+              if (context.payload.action === 'labeled' && context.payload.label && context.payload.label.name === 'ok-to-test') {
+                core.info(`✅ Condition met: ok-to-test label applied by @${context.actor}. Proceeding with tests.`);
+                return; // Success
+              }
+
+              core.info(`   ❌ No ok-to-test label event detected.`);
+              core.setFailed(
+                `❌ Permission check failed. User @${actor} did not meet any required conditions (trusted bot, org/team member, repo write access, or ok-to-test label).`,
+              );
             }
 
             run().catch(err => {