RHOAIENG-58789: trust bots, lgtm/approved, scope xKS triggers

author_association misreports opendatahub-io members with private org
visibility, so maintainers were having to re-add run-xks-e2e after every
commit even for people who are actually trusted. Until a reliable org
membership check is in place, accept the label as long as it is present
on the PR instead of only on the labeled event.

Bot-authored PRs (odh-release-bot, jira-autofix, dependabot) hit the same
gap: author_association reports CONTRIBUTOR for them regardless of the
app's actual permissions, confirmed on opendatahub-io#3768, opendatahub-io#3760, and opendatahub-io#3756. Trust
those exact logins the same way trusted human associations are trusted.

lgtm and approved are trusted too, but only at the exact labeled event,
not whenever present. Prow strips lgtm from a PR on every new commit by
default in this repo (no sticky_lgtm_team or store_tree_hash configured),
so a malicious synchronize commit never carries the labeled action either
label needs, even if Prow hasn't removed the stale lgtm yet. approved
isn't auto-revoked on push, but that doesn't matter here since the check
never inspects current label state, only the labeling event itself.

Given that author_association gap, running the ODH xKS workflow on every
PR relied too much on a trust signal that fails for most of the org. This
workflow only exercises the kserve component on a Cloud Manager-
provisioned cluster (make e2e-test-xks sets E2E_TEST_COMPONENT=kserve),
so scope its trigger to kserve, cloudmanager, and config/rhaii paths
(the manifests make deploy-rhaii-local deploys for this test) instead of
running on every PR. The cloudmanager workflow already has its own path
filter and keeps the label-and-authorization gate as its primary check,
since that is where the actual secret risk is.

Author: rinaldodev

.github/workflows/test-cloudmanager-e2e.yaml

@@ -42,14 +42,27 @@ jobs:
       - name: Check authorization
         env:
           AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
           EVENT_ACTION: ${{ github.event.action }}
           LABEL_NAME: ${{ github.event.label.name }}
+          HAS_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'run-xks-e2e') }}
         run: |
+          TRUSTED_BOTS=("odh-release-bot[bot]" "jira-autofix[bot]" "dependabot[bot]")
           if [[ "$AUTHOR_ASSOCIATION" =~ ^(OWNER|MEMBER|COLLABORATOR)$ ]]; then
             echo "Trusted contributor — running automatically"
             exit 0
           fi
-          if [[ "$EVENT_ACTION" == "labeled" && "$LABEL_NAME" == "run-xks-e2e" ]]; then
+          for bot in "${TRUSTED_BOTS[@]}"; do
+            if [[ "$AUTHOR_LOGIN" == "$bot" ]]; then
+              echo "Trusted bot — running automatically"
+              exit 0
+            fi
+          done
+          if [[ "$EVENT_ACTION" == "labeled" && ( "$LABEL_NAME" == "lgtm" || "$LABEL_NAME" == "approved" ) ]]; then
+            echo "Reviewer approval ($LABEL_NAME) — running automatically"
+            exit 0
+          fi
+          if [[ "$HAS_LABEL" == "true" ]]; then
             echo "External contributor — approved via label"
             exit 0
           fi

.github/workflows/test-kind-odh-e2e.yaml

@@ -5,6 +5,23 @@ on:
     types: [opened, labeled, synchronize, reopened]
     branches:
       - main
+    paths:
+      - 'api/components/v1alpha1/kserve_types.go'
+      - 'internal/controller/components/kserve/**'
+      - 'config/rbac/components_kserve_editor_role.yaml'
+      - 'config/rbac/components_kserve_viewer_role.yaml'
+      - 'tests/e2e/kserve_test.go'
+      - 'cmd/cloudmanager/**'
+      - 'internal/controller/cloudmanager/**'
+      - 'config/cloudmanager/**'
+      - 'api/cloudmanager/**'
+      - 'tests/e2e/cloudmanager/**'
+      - 'pkg/controller/cloudmanager/**'
+      - 'pkg/operatorconfig/cloudmanager.go'
+      - 'pkg/utils/test/cloudmanager/**'
+      - 'config/rhaii/**'
+      - 'get_all_manifests.sh'
+      - '.github/workflows/test-kind-odh-e2e.yaml'
 
 permissions:
   contents: read
@@ -29,14 +46,27 @@ jobs:
       - name: Check authorization
         env:
           AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
           EVENT_ACTION: ${{ github.event.action }}
           LABEL_NAME: ${{ github.event.label.name }}
+          HAS_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'run-xks-e2e') }}
         run: |
+          TRUSTED_BOTS=("odh-release-bot[bot]" "jira-autofix[bot]" "dependabot[bot]")
           if [[ "$AUTHOR_ASSOCIATION" =~ ^(OWNER|MEMBER|COLLABORATOR)$ ]]; then
             echo "Trusted contributor — running automatically"
             exit 0
           fi
-          if [[ "$EVENT_ACTION" == "labeled" && "$LABEL_NAME" == "run-xks-e2e" ]]; then
+          for bot in "${TRUSTED_BOTS[@]}"; do
+            if [[ "$AUTHOR_LOGIN" == "$bot" ]]; then
+              echo "Trusted bot — running automatically"
+              exit 0
+            fi
+          done
+          if [[ "$EVENT_ACTION" == "labeled" && ( "$LABEL_NAME" == "lgtm" || "$LABEL_NAME" == "approved" ) ]]; then
+            echo "Reviewer approval ($LABEL_NAME) — running automatically"
+            exit 0
+          fi
+          if [[ "$HAS_LABEL" == "true" ]]; then
             echo "External contributor — approved via label"
             exit 0
           fi