fix(required-gate): ignore unrelated label changes

.changelog/unreleased/57-required-gate-label-triggers.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- Stop the required-gate caller example from rerunning on arbitrary PR label changes. The `ci:full` classifier label still works when the gate runs, but labels such as `no-changelog` no longer restart the branch-protection gate.

README.md

@@ -72,6 +72,12 @@ repo-required-gate / decision
 
 Keep targeted checks inside the gate or leave them non-required. Do not make branch protection depend on workflows that can be skipped by path filters; GitHub can leave those required checks pending.
 
+The required-gate caller intentionally does not listen for `labeled` or
+`unlabeled` events. Labels such as `no-changelog` should not cancel and restart
+the required branch-protection gate. The `ci:full` label is still honored by the
+classifier when the gate runs; after applying it to an already-open PR, rerun the
+workflow, push a new commit, or use another normal PR event to refresh the gate.
+
 For agent closeout, use the shared local preflight instead of direct promotion:
 
 ```bash

examples/repo-required-gate.yml

@@ -7,16 +7,7 @@ name: Repo Required Gate
 on:
   pull_request:
     branches: [main]
-    types:
-      [
-        opened,
-        edited,
-        synchronize,
-        reopened,
-        ready_for_review,
-        labeled,
-        unlabeled,
-      ]
+    types: [opened, edited, synchronize, reopened, ready_for_review]
   merge_group:
 
 permissions:
@@ -115,5 +106,7 @@ jobs:
       # Default label is `ci:full`. Apply it to a PR to bypass path-based
       # routing and run the full language CI surface — e.g. a workflow-only
       # change that semantically affects CI.
+      # If you add the label after the latest gate run, rerun the workflow,
+      # push a new commit, or use another normal PR event to refresh the gate.
       #
       # force-full-ci-label: ci:full

scripts/workflow-structure.test.mjs

@@ -2,6 +2,7 @@ import { readFileSync } from 'node:fs';
 import { describe, expect, it } from 'vitest';
 
 const readWorkflow = (name) => readFileSync(`.github/workflows/${name}.yml`, 'utf8');
+const readExample = (name) => readFileSync(`examples/${name}.yml`, 'utf8');
 
 const workflowJobBlock = (body, job) => {
   const marker = `  ${job}:`;
@@ -113,6 +114,16 @@ describe('repo-required-gate workflow node delegation', () => {
   });
 });
 
+describe('repo-required-gate caller example', () => {
+  it('does not rerun the required gate for arbitrary label changes', () => {
+    const body = readExample('repo-required-gate');
+
+    expect(body).toContain('types: [opened, edited, synchronize, reopened, ready_for_review]');
+    expect(body).not.toMatch(/^\s*labeled,?\s*$/m);
+    expect(body).not.toMatch(/^\s*unlabeled,?\s*$/m);
+  });
+});
+
 describe('pr-policy workflow contract source', () => {
   it('uses the shared PR contract validator instead of inline body regexes', () => {
     const body = readWorkflow('pr-policy');