fix(ci): don't cancel/rerun PR CI when an unrelated label is added (open-metadata#28737)

Every PR-CI workflow triggers on `pull_request_target` with
`types: [..., labeled]` and used `cancel-in-progress: true`. Adding any
label fired a `labeled` event that joined the same concurrency group and
cancelled the in-flight run; because the PR already carried `safe to
test`, the new run's label gate passed and it reran everything. So adding
a label like `to release` needlessly cancelled and restarted CI.

Gate on the `safe to test` label in two places per workflow:
- concurrency `cancel-in-progress` is now an expression that stays false
  for `labeled` events unless the added label is `safe to test`, so an
  unrelated label no longer cancels the running build.
- the gateway job's `if` carries the same clause, so an unrelated label
  doesn't spawn a duplicate run (downstream `needs:` jobs skip as they
  already do for draft PRs).

`push`/`merge_group`/`workflow_dispatch` are unaffected via the
`event_name != 'pull_request_target'` clause. team-labeler and
auto-cherry-pick (which intentionally act on labels) are left untouched.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ulixius9

.github/workflows/airflow-apis-tests.yml

@@ -23,7 +23,7 @@ permissions:
 
 concurrency:
   group: airflow-apis-tests-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 
 env:
   SONAR_OPTS: >-
@@ -37,7 +37,7 @@ env:
 jobs:
   airflow-apis-tests:
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     steps:
     - name: Free Disk Space (Ubuntu)
       uses: jlumbroso/free-disk-space@main

.github/workflows/integration-tests-mysql-elasticsearch.yml

@@ -34,15 +34,15 @@ permissions:
 
 concurrency:
   group: integration-tests-mysql-es-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 jobs:
   # Detect whether relevant paths changed. When no matching files are modified
   # the downstream job is skipped via its `if` condition.
   # A job skipped by `if` reports as "Success", so required checks still pass.
   changes:
     name: Detect Changes
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     outputs:
       backend: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.filter.outputs.backend }}
     steps:

.github/workflows/integration-tests-postgres-elasticsearch-redis.yml

@@ -49,15 +49,15 @@ permissions:
 
 concurrency:
   group: integration-tests-pg-es-redis-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 jobs:
   # Detect whether relevant paths changed. When no matching files are modified
   # the downstream job is skipped via its `if` condition.
   # A job skipped by `if` reports as "Success", so required checks still pass.
   changes:
     name: Detect Changes
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     outputs:
       backend: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.filter.outputs.backend }}
     steps:

.github/workflows/integration-tests-postgres-opensearch.yml

@@ -34,15 +34,15 @@ permissions:
 
 concurrency:
   group: integration-tests-pg-os-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 jobs:
   # Detect whether relevant paths changed. When no matching files are modified
   # the downstream job is skipped via its `if` condition.
   # A job skipped by `if` reports as "Success", so required checks still pass.
   changes:
     name: Detect Changes
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     outputs:
       backend: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.filter.outputs.backend }}
     steps:

.github/workflows/java-checkstyle.yml

@@ -30,10 +30,11 @@ permissions:
 
 concurrency:
   group: java-checkstyle-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 jobs:
   java-checkstyle:
     runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
     permissions:
       pull-requests: write
 

.github/workflows/maven-build-collate.yml

@@ -46,11 +46,11 @@ permissions:
 
 concurrency:
   group: maven-build-collate-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 jobs:
   maven-collate-ci:
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     steps:
       - name: Wait for the labeler
         uses: lewagon/wait-on-check-action@v1.7.0

.github/workflows/maven-sonar-build.yml

@@ -33,11 +33,11 @@ permissions:
 
 concurrency:
   group: maven-sonar-build-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 jobs:
   maven-sonarcloud-ci:
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     steps:
       - name: Wait for the labeler
         uses: lewagon/wait-on-check-action@v1.7.0

.github/workflows/playwright-integration-tests-mysql.yml

@@ -19,12 +19,12 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 
 jobs:
   playwright-mysql:
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/playwright-integration-tests-postgres.yml

@@ -19,12 +19,12 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 
 jobs:
   playwright-postgresql:
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/playwright-mysql-e2e.yml

@@ -36,12 +36,12 @@ permissions:
 
 concurrency:
   group: playwright-ci-pr-mysql-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test' }}
 
 jobs:
   playwright-ci-mysql:
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft && (github.event_name != 'pull_request_target' || github.event.action != 'labeled' || github.event.label.name == 'safe to test') }}
     environment: test
     env:
       # Playwright logs the admin user in many times (performAdminLogin per test, parallel