Fix(ci): restrict integration tests to trusted contributors or safe-to-test label

Gate the get-sha job in tests-integration.yml so CI runs automatically
only for contributors with explicit repository write access (OWNER or
COLLABORATOR). All others require a maintainer to add the "safe-to-test"
label, which must be done via a labeled event — not checked by label
presence — eliminating any race condition on new commits.

Add remove-safe-to-test-label.yml to automatically strip the
safe-to-test label when a contributor pushes new commits, so a
maintainer must explicitly re-label before CI runs again on the
updated code.

Signed-off-by: Prem Kumar Kalle <prem.kalle@broadcom.com>

Author: prkalle

.github/workflows/remove-safe-to-test-label.yml

@@ -0,0 +1,21 @@
+name: Remove safe-to-test label on new commits
+
+on:
+  pull_request_target:
+    branches:
+      - main
+      - v8
+    types:
+      - synchronize
+
+jobs:
+  remove-label:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')
+    steps:
+      - name: Remove safe-to-test label
+        run: gh pr edit "${{ github.event.pull_request.number }}" --remove-label "safe-to-test"
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/tests-integration.yml

@@ -25,6 +25,11 @@ on:
     branches:
       - main
       - v8
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
     paths-ignore:
       - "doc/**"
       - ".gitpod.yml"
@@ -33,7 +38,13 @@ on:
 jobs:
   get-sha:
     runs-on: ubuntu-latest
-    if: ${{ github.actor != 'dependabot[bot]' }}
+    if: |
+      ${{ github.actor != 'dependabot[bot]' && (
+        github.event.pull_request.author_association == 'OWNER' ||
+        github.event.pull_request.author_association == 'COLLABORATOR' ||
+        (github.event_name == 'labeled' &&
+         github.event.label.name == 'safe-to-test')
+      ) }}
     outputs:
       gitRef: ${{steps.calculate.outputs.ref}}
     steps: