askalf · Nov 2, 2026 · Nov 2, 2026
@@ -31,7 +31,7 @@ the job `if:` that keeps a fork's own `pull_request` events out.
 jobs:
   status:
     if: >-
-      ...                      # the fork and comment rules; fleet-status-check reads them
+      ...                      # the fork, comment and label rules; fleet-status-check reads them
     runs-on: ${{ github.repository == 'askalf/<repo>' && fromJSON('["self-hosted","fleet-status"]') || 'ubuntu-latest' }}
     permissions:
       contents: read

@@ -7,7 +7,7 @@
 //     pull_request_target, runs one status job, groups and cancels only workflow_run runs, and its
 //     job if: keeps a fork's pull_request and pull_request_review events out (they carry a read-only
 //     token and the PR merge ref's workflow) while letting a fork's finished CI, review relay and
-//     verification comments in.
+//     verification comments in, and runs on a label event only for the one label the lanes read.
 //   - The status job runs actions/fleet-status of askalf/ci at a full commit sha and nothing else:
 //     no checkout, no run step. That is what lets a fork's events run it with a write token.
 //   - The self-test runs on pull_request (and a dispatch) alone, and runs fleet-status-check: on
@@ -667,6 +667,13 @@ export function checkCaller(dir, opts = {}) {
   check('a fork\'s pull_request event does not run the job', !onPr('pull_request', FORKED));
   check('a fork\'s pull_request_review event does not run the job', !onPr('pull_request_review', FORKED));
   check('a same-repo pull_request and review run it', onPr('pull_request', HOME) && onPr('pull_request_review', HOME));
+  // The lanes read one label, `verified` (fleet-status.mjs), so only that label changing runs the
+  // job; every other label event is a status run that posts nothing new, and a Dependabot PR fires
+  // two as it opens. A label the lanes come to read is added here and in the callers' if:.
+  const onLabel = (action, name) => runs({ event_name: 'pull_request', event: { action, label: { name }, pull_request: { head: { repo: { full_name: HOME } } } } });
+  check('the verified label added or removed runs it', onLabel('labeled', 'verified') && onLabel('unlabeled', 'verified'));
+  check('any other label added or removed does not run it (the lanes read none)',
+    !onLabel('labeled', 'dependencies') && !onLabel('unlabeled', 'dependencies') && !onLabel('labeled', ''));
   check('a verification comment on a PR runs it, fork or not; one on an issue does not',
     onComment('## Verification at abc1234\n\nPassed.')
     && !runs({ event_name: 'issue_comment', event: { issue: {}, comment: { body: '## Verification at abc1234' } } }));

@@ -161,7 +161,9 @@ console.log('\n  each break is caught');
 const STATUS = 'fleet-status.yml';
 const cases = [
   ['a pull_request workflow missing from the refresh list', { 'lint.yml': () => onPr('lint') }, /are all listed \(missing: lint\)/],
-  ['a fork pull_request let into the job', { [STATUS]: (y) => y.replace("github.event.pull_request.head.repo.full_name == github.repository)", 'true)') }, /fork's pull_request event does not run/],
+  ['a fork pull_request let into the job', { [STATUS]: (y) => y.replace("github.event.pull_request.head.repo.full_name == github.repository &&\n", "true &&\n") }, /fork's pull_request event does not run/],
+  ['any label event let in', { [STATUS]: (y) => y.replace("(!contains(fromJSON('[\"labeled\",\"unlabeled\"]'), github.event.action) ||", "(true ||") }, /any other label added or removed does not run it/],
+  ['the verified label kept out', { [STATUS]: (y) => y.replace("github.event.label.name == 'verified'))", "github.event.label.name == 'checked'))") }, /the verified label added or removed runs it/],
   ['any comment let in', { [STATUS]: (y) => y.replace("(startsWith(github.event.comment.body, '## Verification at') ||", "(true ||") }, /any other comment does not run it/],
   ['a checkout step in the status job', { [STATUS]: (y) => y.replace('    steps:\n', '    steps:\n      - uses: actions/checkout@0000000000000000000000000000000000000000\n') }, /no other action/],
   ['a run step in the status job', { [STATUS]: (y) => `${y}      - run: node x.mjs\n` }, /has no run step/],

@@ -42,6 +42,8 @@ jobs:
     # issue_comment fires for issues too; only PR comments matter. The script re-checks it.
     # Of those, only a verification comment changes a status, so a comment runs the job when it is
     # one, when an edit changed it away from one, or when one is deleted.
+    # Of the labels, the lanes read only `verified`, so a label added or removed runs the job only
+    # when it is that one (a Dependabot PR adds two others as it opens).
     if: >-
       (github.event_name == 'issue_comment' && github.event.issue.pull_request != null &&
        (startsWith(github.event.comment.body, '## Verification at') ||
@@ -53,7 +55,9 @@ jobs:
         (contains(fromJSON('["pull_request","pull_request_target","pull_request_review"]'), github.event.workflow_run.event) &&
          github.event.workflow_run.head_repository.full_name != github.repository))) ||
       (github.event_name != 'issue_comment' && github.event_name != 'workflow_run' &&
-       github.event.pull_request.head.repo.full_name == github.repository)
+       github.event.pull_request.head.repo.full_name == github.repository &&
+       (!contains(fromJSON('["labeled","unlabeled"]'), github.event.action) ||
+        github.event.label.name == 'verified'))
     # On our runner for every event here, a fork PR's included: the job runs the pinned fleet-status
     # action and never PR code (see above), so GitHub's hosted queue going down does not hold the
     # fleet/verify and fleet/review statuses a merge waits on. A fork repository has no