feat: run GitLab E2E for labeled fork pull requests

[fengmk2]

Fork pull requests currently skip GitLab E2E because pull_request workflows cannot access GITLAB_TRIGGER_TOKEN.

Allow maintainers with write access to request the full suite with the run-e2e label. A pull_request helper starts the trusted workflow_run handler. The handler checks the labeler, helper file, PR state, and exact head SHA before it calls GitLab. It does not load fork code, artifacts, or caches. This flow uses no pull_request_target trigger.

Both workflows must reach main before use. The fork branch must include the unchanged helper. New commits require another review and a new run-e2e label event.

[Copilot]

🟡 Changes recommended

The privileged workflow’s invalid workflow_run path check prevents approved fork requests from triggering GitLab E2E.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a label-gated workflow for maintainers to request GitLab E2E runs on fork pull requests.

Changes:

• Adds unprivileged request and trusted validation workflows.
• Validates permissions, PR state, helper integrity, and commit SHA.
• Adds security-focused tests and documentation.

File summaries

File	Summary
src/gitlab/workflow.test.ts	Tests workflow security and parameter resolution.
README.md	Documents the fork PR E2E approval flow.
.github/workflows/gitlab-e2e.yml	Validates requests and triggers GitLab; the workflow_run path check is invalid, blocking execution.
.github/workflows/e2e-request.yml	Requests E2E runs for labeled fork pull requests.

Review details

Suppressed comments (3)

.github/workflows/gitlab-e2e.yml:102

• workflow_run.head_sha is the SHA associated with the pull_request run's test-merge ref, whereas the helper's run name records github.event.pull_request.head.sha (the fork branch tip). Thus a normal fork approval has different values here and exits at line 99 before checking the PR or triggering GitLab. Once the exact helper blob has been verified, use the SHA captured from the validated title (BASH_REMATCH[2]) for the blob, PR, and setup_vp_ref checks instead of comparing it to workflow_run.head_sha.

              if [ "${BASH_REMATCH[2]}" != "$REQUEST_HEAD_SHA" ]; then
                echo "::error::The request title does not match the workflow run's head SHA."
                exit 1
              fi

.github/workflows/gitlab-e2e.yml:120

• REQUEST_HEAD_SHA is the commit in REQUEST_HEAD_REPOSITORY, but this Contents API request is scoped to ${GITHUB_REPOSITORY}. A normal fork-only commit is not a ref in the upstream repository, so this lookup returns 404 and every otherwise valid approval exits with the "must include e2e-request.yml" error before triggering GitLab. Fetch the request blob from REQUEST_HEAD_REPOSITORY at the exact SHA; keep trusted_blob on the base repository.

              if ! request_blob="$(gh api "repos/${GITHUB_REPOSITORY}/contents/${workflow_path}?ref=${REQUEST_HEAD_SHA}" --jq '.sha')" ||

.github/workflows/gitlab-e2e.yml:134

• This passes only the fork's SHA to the GitLab project, but the GitLab template/bootstrap download bootstrap.sh and dist/gitlab/index.mjs from the fixed voidzero-dev/setup-vp raw URLs (gitlab/setup-vp.yml:62, gitlab/bootstrap.sh:272). A commit that exists only in the fork is not a usable upstream ref, so the approved fork pipeline cannot load the fork files as documented. Pass the head repository (or a fork-qualified PR ref) through the trigger and update the GitLab-side downloads to use it while retaining the immutable SHA check.

                setup_vp_ref="$REQUEST_HEAD_SHA"

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Security-sensitive workflow changes warrant final human review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The trusted workflow and fork/secret boundary warrant final human review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite