CI: Do not allow merge if labelled DO-NOT-MERGE

[hugovk]

For python/core-workflow#498.

Before switching to GitHub's own auto-merge, we need to make sure it respects the DO-NOT-MERGE label.

We can use https://github.com/mheap/github-action-required-labels to prevent merge if a label exists. We will set this new check as required, and it only passes when DO-NOT-MERGE is absent.

Docs: https://github.com/mheap/github-action-required-labels#prevent-merging-if-a-label-exists

This will also disable the merge button for PRs with DO-NOT-MERGE , regardless of using GitHub auto-merge, which will also help avoid accidental merges.

TODO

• Bikeshed on workflow filename and name:
• Org admin: in the branch protection rules (for all branches with rules), set this new check as required
• Include GitHub auto-merge in the label description at https://devguide.python.org/triage/labels/#labels-specific-to-prs

Demo

In my fork, I've set the check to required and created a demo PR: hugovk#47

No label: can merge

With label: cannot merge

[sobolevn]

Looks good!
Require PR label seems like an odd name for this workflow, though.

Maybe it can be more generic like Check PR labels?

[CAM-Gerlach]

Great idea overall; I'd been wanting to add something like this for a while now. We should probably backport this at least to 3.11, since automerge functionality is particularly common on auto-backport PRs.

[sobolevn]

LGTM 👍

Shout out to @mheap for developing this useful GH action 👋

[CAM-Gerlach]

LGTM now, thanks @hugovk !

[miss-islington]

Thanks @hugovk for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

[bedevere-bot]

GH-103393 is a backport of this pull request to the 3.11 branch.

[bedevere-bot]

GH-103641 is a backport of this pull request to the 3.10 branch.