From 838bcb0d934908f045f9ec171ca15677ddb9f282 Mon Sep 17 00:00:00 2001
From: Chang Su <chang.s.su@oracle.com>
Date: Mon, 10 Nov 2025 10:41:54 -0800
Subject: [PATCH] [misc][ci] Add run-ci after auto-labeler (#13013)

---
 .github/workflows/label-pr.yml | 36 ----------------------------------
 .github/workflows/labeler.yml  | 28 +++++++++++++++++++++++++-
 2 files changed, 27 insertions(+), 37 deletions(-)
 delete mode 100644 .github/workflows/label-pr.yml

diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml
deleted file mode 100644
index 8e88d6494..000000000
--- a/.github/workflows/label-pr.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: Label PR for CI
-
-on:
-  pull_request_target:
-    types: [opened, reopened]
-
-# This permission is still needed for the 'check-user-permission' action,
-# which uses the default GITHUB_TOKEN to verify the actor's permissions.
-permissions:
-  pull-requests: read
-
-jobs:
-  labeler:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check user permission
-        id: checkAccess
-        uses: actions-cool/check-user-permission@v2
-        with:
-          require: write
-          username: ${{ github.triggering_actor }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Add run-ci label
-        if: steps.checkAccess.outputs.require-result == 'true'
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GH_PAT_FOR_PULL_REQUEST }}
-          script: |
-            github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              labels: ['run-ci']
-            })
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index f065d530d..cd0f9afe7 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -12,8 +12,34 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      # Step 1: Add category labels based on file changes
+      - name: Auto-label by file changes
+        uses: actions/labeler@v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           configuration-path: .github/labeler.yml
           sync-labels: false
+
+      # Step 2: Add run-ci label for authorized users (only on opened/reopened)
+      - name: Check user permission
+        if: github.event.action == 'opened' || github.event.action == 'reopened'
+        id: checkAccess
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          username: ${{ github.triggering_actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add run-ci label
+        if: (github.event.action == 'opened' || github.event.action == 'reopened') && steps.checkAccess.outputs.require-result == 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GH_PAT_FOR_PULL_REQUEST }}
+          script: |
+            github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['run-ci']
+            })