fix(playwright): run trusted fork updates

[harshach]

What changed

• Move fork safe to test invalidation into the Team Label job so invalidation and trusted-author revalidation are ordered.
• Make the PostgreSQL + OpenSearch Playwright gate wait for Team Label and read the live PR labels.
• Keep MySQL + Elasticsearch on the same reconciled-label contract and pin its wait action for safe re-enablement.
• Use the gate result as the source of truth for the required playwright-summary check name.

Root cause

The PostgreSQL Playwright gate removed safe to test and skipped every fork synchronize event. Team Label then restored the label for allowlisted authors with GITHUB_TOKEN, but GitHub intentionally does not launch another workflow for that bot-generated labeled event. As a result, trusted fork updates never reached Playwright.

This keeps approval SHA-scoped for untrusted forks while automatically revalidating authors listed under safe to test in .github/teams.yml on the existing synchronize event.

The MySQL + Elasticsearch workflow already waits for Team Label and verifies the live label, but it is currently disabled at the GitHub workflow level. After this fix merges, it will be re-enabled before #30484 is updated so both database/search variants exercise the corrected path.

Validation

• actionlint on all three changed workflows, excluding the workflows' pre-existing allow-unsafe-pr-checkout metadata warnings
• trusted/untrusted fork and same-repo gate scenario matrix
• idempotent label-invalidation scenarios for success, 404, and non-404 failure
• uv run --with pytest python -m pytest -q .github/scripts/tests/test_playwright_ci_planning.py .github/scripts/tests/test_playwright_pr_comment.py — 59 passed
• git diff --check

After merge, PR #30484 will be updated from main to exercise both PostgreSQL + OpenSearch and MySQL + Elasticsearch.

This urgent CI regression fix uses the maintainer skip-pr-checks bypass because it does not have a product issue.

Greptile Summary

This PR hardens trusted-fork Playwright workflow coordination.

• Moves fork approval invalidation into the Team Label job and handles an already-absent label.
• Makes the PostgreSQL gate wait for reconciliation and evaluate live pull-request labels.
• Derives the required Playwright summary check name from the gate result.
• Pins the changed wait-on-check action references to a full commit SHA.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failures remain within the eligible follow-up scope.

Important Files Changed

Filename	Overview
.github/workflows/team-labeler.yml	Moves fork approval invalidation before trusted-author relabeling and safely tolerates concurrent removal of the label.
.github/workflows/playwright-postgresql-e2e.yml	Waits for Team Label reconciliation, reads live fork labels, and uses the gate result to select the authoritative summary check.
.github/workflows/playwright-mysql-e2e.yml	Adds the check-read permission and pins the Team Label wait action to a full commit SHA.

Sequence Diagram

sequenceDiagram
  participant Sync as Fork synchronize event
  participant Label as Team Label job
  participant API as GitHub API
  participant Gate as PostgreSQL gate
  participant Tests as Playwright jobs
  Sync->>Label: Start reconciliation for current head SHA
  Label->>API: Remove stale safe-to-test label
  Label->>Label: Revalidate allowlisted author
  Label->>API: Restore label when trusted
  Gate->>Label: Wait for Team Label check
  Gate->>API: Read live pull-request labels
  Gate->>Gate: Compute should_run
  alt should_run is true
    Gate->>Tests: Authorize Playwright execution
  else should_run is false
    Gate->>Tests: Publish skipped summary name
  end

Loading

_{Reviews (2): Last reviewed commit: "fix(playwright): harden fork label recon..." | Re-trigger Greptile}

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[Copilot]

Pull request overview

This PR fixes the Playwright PostgreSQL E2E gating logic for fork PR updates by ensuring safe to test invalidation/revalidation happens in a deterministic order and that the gate reads the reconciled labels for the current head SHA (so trusted forks can run on synchronize).

Changes:

• Move fork safe to test invalidation into the Team Label workflow/job so it can invalidate then revalidate allowlisted authors in the same run.
• Update the Playwright PostgreSQL gate to wait for the Team Label check and then read the current PR labels before computing should_run.
• Make playwright-summary check naming depend on the gate result, so skipped sibling events don’t satisfy branch protection early.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/team-labeler.yml	Adds a fork-sync invalidation step ahead of the trusted-author labeler step.
.github/workflows/playwright-postgresql-e2e.yml	Waits for Team Label reconciliation, reads live labels, and uses the gate result for playwright-summary naming.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[gitar-bot]

Code Review ✅ Approved

Hardens fork label reconciliation by reordering the fork safe to test invalidation into the Team Label job and updating the Playwright gate to read live PR labels. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}