[CI] fix triggered by a non-run-ci label (#13393)

.github/workflows/pr-test.yml

@@ -5,7 +5,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
-    types: [synchronize, labeled]
+    types: [synchronize]
   workflow_dispatch:
     inputs:
       version:
@@ -25,8 +25,12 @@ env:
   SGLANG_IS_IN_CI: true
 
 jobs:
+  call-gate:
+    uses: ./.github/workflows/pr-gate.yml
+    secrets: inherit
   # =============================================== check changes ====================================================
   check-changes:
+    needs: [call-gate]
     runs-on: ubuntu-latest
     outputs:
       main_package: ${{ steps.filter.outputs.main_package }}
@@ -36,76 +40,6 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Fail if the PR does not have the 'run-ci' label
-        if: github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'run-ci')
-        run: |
-          echo "This pull request does not have the 'run-ci' label. Failing the workflow."
-          exit 1
-
-      - name: Fail if the PR is a draft
-        if: github.event_name == 'pull_request' && github.event.pull_request.draft == true
-        run: |
-          echo "This pull request is a draft. Failing the workflow."
-          exit 1
-
-      - name: Enforce rate limit for low-permission actors
-        if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const HOURS = 2;
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const eventName = context.eventName;
-            const curRun = await github.rest.actions.getWorkflowRun({
-              owner, repo, run_id: context.runId
-            });
-            const triggeringActor = curRun.data.triggering_actor?.login || context.actor;
-
-            async function hasHighPermission(username) {
-              try {
-                const { data } = await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username });
-                const perm = data.permission || 'none';
-                return perm === 'write' || perm === 'maintain' || perm === 'admin';
-              } catch (e) {
-                if (e.status === 404 || e.status === 403) return false;
-                throw e;
-              }
-            }
-
-            if (await hasHighPermission(triggeringActor)) {
-              core.info(`Triggering user '${triggeringActor}' has high permission. No rate limit applied.`);
-              return;
-            }
-
-            const cutoff = new Date(Date.now() - HOURS * 60 * 60 * 1000);
-            core.info(`Checking for workflow runs since ${cutoff.toISOString()} (last ${HOURS} hours) for event '${eventName}'.`);
-
-            const { data } = await github.rest.actions.listWorkflowRuns({
-              owner,
-              repo,
-              workflow_id: 'pr-test.yml',
-              event: eventName,
-              per_page: 100,
-            });
-
-            const runs = data.workflow_runs || [];
-            const recentFound = runs.find((run) => {
-              if (String(run.id) === String(context.runId)) return false;
-              if (new Date(run.created_at) < cutoff) return false;
-              return (run.actor?.login === triggeringActor) || (run.triggering_actor?.login === triggeringActor);
-            });
-
-            if (recentFound) {
-              core.setFailed(
-                `User '${triggeringActor}' already triggered '${context.workflow}' via '${eventName}' at ${recentFound.created_at}. ` +
-                `Please wait ${HOURS} hours before triggering again.`
-              );
-            } else {
-              core.info(`No recent runs detected within the last ${HOURS} hours; proceeding.`);
-            }
-
       - name: Detect file changes
         id: filter
         uses: dorny/paths-filter@v3
@@ -1036,6 +970,7 @@ jobs:
   pr-test-finish:
     needs:
       [
+        call-gate,
         check-changes,
 
         sgl-kernel-build-wheels,