From f4cc61862d0498aa194c5c3d92263fb158c6dc8c Mon Sep 17 00:00:00 2001
From: Roger <50648015+RogerLamTd@users.noreply.github.com>
Date: Fri, 8 Nov 2024 17:30:34 -0800
Subject: [PATCH] feat(repo): fix workflows, restore merge-gatekeeper (#18471)

---
 .github/workflows/bridge-ui.yml               |  6 +++---
 .github/workflows/docs-site--preview.yml      |  2 +-
 .github/workflows/eventindexer.yml            |  6 +++---
 .github/workflows/fork-diff--preview.yml      |  2 +-
 .../guardian-prover-health-check-ui--ci.yml   |  1 +
 .../guardian-prover-health-check-ui.yml       |  6 +++---
 .../guardian-prover-health-check.yml          |  6 +++---
 .github/workflows/nfts.yml                    |  2 +-
 .github/workflows/protocol-monitors.yml       |  2 +-
 .github/workflows/protocol.yml                |  4 ++--
 .github/workflows/relayer.yml                 |  6 +++---
 .github/workflows/repo--merge-gatekeeper.yml  | 21 +++++++++++++++++++
 .github/workflows/supplementary-contracts.yml |  2 +-
 .github/workflows/taiko-client--hive_test.yml |  2 +-
 .github/workflows/taiko-client--test.yml      |  4 ++--
 15 files changed, 47 insertions(+), 25 deletions(-)
 create mode 100644 .github/workflows/repo--merge-gatekeeper.yml

diff --git a/.github/workflows/bridge-ui.yml b/.github/workflows/bridge-ui.yml
index 863ad8beb52..68815001452 100644
--- a/.github/workflows/bridge-ui.yml
+++ b/.github/workflows/bridge-ui.yml
@@ -17,7 +17,7 @@ on:
 
 jobs:
   build-and-test:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     uses: ./.github/workflows/bridge-ui--ci.yml
 
   # Deployment name follow the pattern: deploy_<appname(bridge-ui)>_<network(devnet|hekla|mainnet)>_<environment(preview|production)>
@@ -37,7 +37,7 @@ jobs:
 
   # Hekla testnet
   deploy_bridge-ui_hekla_preview:
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     needs: build-and-test
     uses: ./.github/workflows/repo--vercel-deploy.yml
     with:
@@ -62,7 +62,7 @@ jobs:
 
   # Mainnet
   deploy_bridge-ui_mainnet_preview:
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     needs: build-and-test
     uses: ./.github/workflows/repo--vercel-deploy.yml
     with:
diff --git a/.github/workflows/docs-site--preview.yml b/.github/workflows/docs-site--preview.yml
index d5b8a5df14a..406087e9508 100644
--- a/.github/workflows/docs-site--preview.yml
+++ b/.github/workflows/docs-site--preview.yml
@@ -14,7 +14,7 @@ on:
 
 jobs:
   deploy-docs-site-preview:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [arc-runner-set]
     steps:
       - name: Install Git
diff --git a/.github/workflows/eventindexer.yml b/.github/workflows/eventindexer.yml
index e69ed716b8d..ac9e655c252 100644
--- a/.github/workflows/eventindexer.yml
+++ b/.github/workflows/eventindexer.yml
@@ -19,7 +19,7 @@ on:
 jobs:
   lint-eventindexer:
     name: lint-eventindexer
-    if: github.event_name == 'pull_request'
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please' && !startsWith(github.head_ref, 'refs/heads/dependabot/')) }}
     runs-on: [arc-runner-set]
     steps:
       - uses: actions/setup-go@v5
@@ -38,7 +38,7 @@ jobs:
 
   test-eventindexer:
     runs-on: [arc-runner-set]
-    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please' && !startsWith(github.head_ref, 'refs/heads/dependabot/')) }}
     needs: lint-eventindexer
     steps:
       - name: Cancel Previous Runs
@@ -66,7 +66,7 @@ jobs:
 
   push-eventindexer-docker-image:
     # Skip dependabot PRs
-    if: ${{ github.event_name == 'pull_request' && ! startsWith(github.ref, 'refs/heads/dependabot/') }}
+    if: ${{ github.event_name == 'pull_request' && ! startsWith(github.head_ref, 'refs/heads/dependabot/') && !startsWith(github.head_ref, 'release-please') }}
     name: Build and push docker image
     runs-on: [arc-runner-set]
 
diff --git a/.github/workflows/fork-diff--preview.yml b/.github/workflows/fork-diff--preview.yml
index a3c75218541..cc1af86c65d 100644
--- a/.github/workflows/fork-diff--preview.yml
+++ b/.github/workflows/fork-diff--preview.yml
@@ -14,7 +14,7 @@ on:
 
 jobs:
   deploy-fork-diff-preview:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [arc-runner-set]
     steps:
       - name: Install Git
diff --git a/.github/workflows/guardian-prover-health-check-ui--ci.yml b/.github/workflows/guardian-prover-health-check-ui--ci.yml
index c2935406a18..abdf477b41b 100644
--- a/.github/workflows/guardian-prover-health-check-ui--ci.yml
+++ b/.github/workflows/guardian-prover-health-check-ui--ci.yml
@@ -4,6 +4,7 @@ on: workflow_call
 
 jobs:
   check-guardian-prover-health-check-ui:
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') && !startsWith(github.head_ref, 'refs/heads/dependabot/') }}
     runs-on: [taiko-runner]
     steps:
       - name: Cancel previous runs
diff --git a/.github/workflows/guardian-prover-health-check-ui.yml b/.github/workflows/guardian-prover-health-check-ui.yml
index 7bf6a6eef0d..ad0d4aa069c 100644
--- a/.github/workflows/guardian-prover-health-check-ui.yml
+++ b/.github/workflows/guardian-prover-health-check-ui.yml
@@ -17,7 +17,7 @@ jobs:
   # Deployment name follow the pattern: deploy_<appname(guardian-prover-health-check-ui)>_<network(devnet|hekla|mainnet)>_<environment(preview|production)>
 
   # deploy_guardians-ui_devnet_preview:
-  #   if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+  #   if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
   #   needs: build-and-test
   #   uses: ./.github/workflows/repo--vercel-deploy.yml
   #   with:
@@ -31,7 +31,7 @@ jobs:
 
 
   deploy_guardians-ui_hekla_preview:
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     needs: build-and-test
     uses: ./.github/workflows/repo--vercel-deploy.yml
     with:
@@ -43,7 +43,7 @@ jobs:
       vercel_token: ${{ secrets.VERCEL_TOKEN }}
 
   deploy_guardians-ui_mainnet_preview:
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     needs: build-and-test
     uses: ./.github/workflows/repo--vercel-deploy.yml
     with:
diff --git a/.github/workflows/guardian-prover-health-check.yml b/.github/workflows/guardian-prover-health-check.yml
index 01c814a72d3..d27542c8d34 100644
--- a/.github/workflows/guardian-prover-health-check.yml
+++ b/.github/workflows/guardian-prover-health-check.yml
@@ -17,7 +17,7 @@ on:
 
 jobs:
   lint-guardian-prover-health-check:
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     name: lint-guardian-prover-health-check
     runs-on: [taiko-runner]
     steps:
@@ -36,7 +36,7 @@ jobs:
           args: --config=.golangci.yml --timeout=4m
 
   test-guardian-prover-health-check:
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [taiko-runner]
     needs: lint-guardian-prover-health-check
     steps:
@@ -62,7 +62,7 @@ jobs:
 
   push-guardian-prover-health-check-docker-image:
     # Skip dependabot PRs
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please' && !startsWith(github.head_ref, 'refs/heads/dependabot/')) }}
     name: Build and push docker image
     runs-on: [taiko-runner]
 
diff --git a/.github/workflows/nfts.yml b/.github/workflows/nfts.yml
index 5ac04faffb5..269caac6802 100644
--- a/.github/workflows/nfts.yml
+++ b/.github/workflows/nfts.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   build-nfts-contracts:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [arc-runner-set]
     steps:
       - name: Cancel previous runs
diff --git a/.github/workflows/protocol-monitors.yml b/.github/workflows/protocol-monitors.yml
index e59220bee69..ad640962afe 100644
--- a/.github/workflows/protocol-monitors.yml
+++ b/.github/workflows/protocol-monitors.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   deploy-protocol-monitors:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [taiko-runner]
     permissions:
       # Give the necessary permissions for stefanzweifel/git-auto-commit-action.
diff --git a/.github/workflows/protocol.yml b/.github/workflows/protocol.yml
index 913e10d9108..174b02a4df0 100644
--- a/.github/workflows/protocol.yml
+++ b/.github/workflows/protocol.yml
@@ -15,7 +15,7 @@ on:
 
 jobs:
   build-protocol:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [arc-runner-set]
     permissions:
       # Give the necessary permissions for stefanzweifel/git-auto-commit-action.
@@ -69,7 +69,7 @@ jobs:
           pnpm test:deploy:l1
 
   genesis-docker:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [taiko-runner]
     permissions:
       # Give the necessary permissions for stefanzweifel/git-auto-commit-action.
diff --git a/.github/workflows/relayer.yml b/.github/workflows/relayer.yml
index 69096c96642..c82b9a18fe9 100644
--- a/.github/workflows/relayer.yml
+++ b/.github/workflows/relayer.yml
@@ -19,7 +19,7 @@ on:
 jobs:
   lint-relayer:
     name: lint-relayer
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') && !startsWith(github.head_ref, 'refs/heads/dependabot/')}}
     runs-on: [arc-runner-set]
     steps:
       - uses: actions/setup-go@v5
@@ -37,7 +37,7 @@ jobs:
           args: --config=.golangci.yml --timeout=4m
 
   test-relayer:
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') && !startsWith(github.head_ref, 'refs/heads/dependabot/') }}
     runs-on: [arc-runner-set]
     needs: lint-relayer
     steps:
@@ -66,7 +66,7 @@ jobs:
 
   push-relayer-docker-image:
     # Skip dependabot PRs
-    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'option.workflow_on') || github.event.pull_request.draft == false && github.head_ref != 'release-please-*') }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') && !startsWith(github.head_ref, 'refs/heads/dependabot/') }}
     name: Build and push docker image
     runs-on: [arc-runner-set]
 
diff --git a/.github/workflows/repo--merge-gatekeeper.yml b/.github/workflows/repo--merge-gatekeeper.yml
new file mode 100644
index 00000000000..08db85e59a6
--- /dev/null
+++ b/.github/workflows/repo--merge-gatekeeper.yml
@@ -0,0 +1,21 @@
+name: Merge Gatekeeper
+
+on:
+  pull_request:
+    branches:
+      - main
+  merge_group: # Trigger in merge queue to pass the required status check
+
+jobs:
+  merge-gatekeeper:
+    if: github.event_name == 'pull_request'
+    runs-on: [arc-runner-set]
+    permissions:
+      checks: read
+      statuses: read
+    steps:
+      - name: Run Merge Gatekeeper
+        uses: upsidr/merge-gatekeeper@v1
+        with:
+          timeout: 1200
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/supplementary-contracts.yml b/.github/workflows/supplementary-contracts.yml
index 396d268181b..1fb4203d178 100644
--- a/.github/workflows/supplementary-contracts.yml
+++ b/.github/workflows/supplementary-contracts.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   build-supplementary-contracts:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     runs-on: [arc-runner-set]
     steps:
       - name: Cancel previous runs
diff --git a/.github/workflows/taiko-client--hive_test.yml b/.github/workflows/taiko-client--hive_test.yml
index bf8a3312d14..33ecbac03c0 100644
--- a/.github/workflows/taiko-client--hive_test.yml
+++ b/.github/workflows/taiko-client--hive_test.yml
@@ -12,7 +12,7 @@ on:
 
 jobs:
   hive_tests:
-    if: contains(github.event.pull_request.labels.*.name, 'option.workflow_on') && github.event.pull_request.draft == false && github.head_ref != 'release-please-*'
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     name: hive tests
     runs-on: [arc-runner-set]
     timeout-minutes: 40
diff --git a/.github/workflows/taiko-client--test.yml b/.github/workflows/taiko-client--test.yml
index 54f4caadb76..0df43a2b887 100644
--- a/.github/workflows/taiko-client--test.yml
+++ b/.github/workflows/taiko-client--test.yml
@@ -12,7 +12,7 @@ on:
 
 jobs:
   lint:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     name: Lint
     runs-on: [ubuntu-latest]
     steps:
@@ -32,7 +32,7 @@ jobs:
         run: golangci-lint run --path-prefix=./ --config=.golangci.yml
 
   integration_tests:
-    if: ${{ github.event.pull_request.draft == false }}
+    if: ${{ github.event.pull_request.draft == false  && !startsWith(github.head_ref, 'release-please') }}
     name: Integration tests
     runs-on: [ubuntu-latest]
     timeout-minutes: 15