ci: check mergable by label

.github/workflows/check-mergable-by-label.yml

@@ -0,0 +1,34 @@
+name: Check mergable by label
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - edited
+      - labeled
+      - unlabeled
+
+permissions:
+  pull-requests: read
+
+jobs:
+  fail-by-blocking-label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if PR is labeled by a blocking label
+        run: |
+          BLOCKING_LABELS=("do NOT merge yet" "s: on hold")
+          PR_LABELS=$(jq -r '.pull_request.labels[].name' "$GITHUB_EVENT_PATH")
+
+          for LABEL in "${BLOCKING_LABELS[@]}"; do
+            if [[ "$PR_LABELS" == *"$LABEL"* ]]; then
+              echo "This PR has a blocking label: $LABEL"
+              exit 1
+            fi
+          done
+
+          echo "No blocking labels found"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}