From 339644e8ed6f53506abd657b0e5e51c6a39b0fa6 Mon Sep 17 00:00:00 2001
From: Alice Frosi <afrosi@redhat.com>
Date: Fri, 18 Sep 2026 09:05:43 +0000
Subject: [PATCH] gha: gate CI on org membership or ok-to-test label

Execute the CI if the author is an org member or if the PR is labeled
with the ok-to-test if we trust the author of the PR.

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
---
 .github/workflows/check-permissions.yml | 14 ++++++++++++++
 .github/workflows/ci.yaml               |  7 +++++++
 .github/workflows/zizmor.yml            |  5 +++++
 3 files changed, 26 insertions(+)
 create mode 100644 .github/workflows/check-permissions.yml

diff --git a/.github/workflows/check-permissions.yml b/.github/workflows/check-permissions.yml
new file mode 100644
index 00000000..aa470cb3
--- /dev/null
+++ b/.github/workflows/check-permissions.yml
@@ -0,0 +1,14 @@
+name: Check Permissions
+
+on:
+  workflow_call:
+
+jobs:
+  authorize:
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'push' ||
+      contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), github.event.pull_request.author_association) ||
+      contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+    steps:
+      - run: echo "CI authorized"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b62d921f..8600df0d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -6,6 +6,7 @@ on:
     tags: ["v*"]
   pull_request:
     branches: [main]
+    types: [opened, synchronize, reopened, labeled]
 
 env:
   BINK_COMMIT: e7d4574fdc610a9fd9bd067aff984516ec7c507d
@@ -17,7 +18,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  check-permissions:
+    uses: $/.github/workflows/check-permissions.yml
+
   unit:
+    needs: [check-permissions]
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -48,6 +53,7 @@ jobs:
         run: make lint
 
   build-bink:
+    needs: [check-permissions]
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -84,6 +90,7 @@ jobs:
           path: bink
 
   build-operator:
+    needs: [check-permissions]
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 42726edb..326e47f1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -5,11 +5,16 @@ on:
     branches: [main]
   pull_request:
     branches: ["**"]
+    types: [opened, synchronize, reopened, labeled]
 
 permissions: {}
 
 jobs:
+  check-permissions:
+    uses: $/.github/workflows/check-permissions.yml
+
   zizmor:
+    needs: [check-permissions]
     name: Scan GHA workflows
     runs-on: ubuntu-24.04
     permissions: