From 86f9d4b7a97e2efc42bb62e58aa1270096369e02 Mon Sep 17 00:00:00 2001
From: Gabriel Stein <steindleve@gmail.com>
Date: Thu, 30 Jul 2026 14:32:15 -0700
Subject: [PATCH] ci: block merge when PR carries 'Do not merge' label

ci: make Do-not-merge label check case-insensitive

ci: standardize block-merge-label error message
---
 .github/workflows/ci.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b40f53bfd8..06241e0d01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 name: ForgeRock Pull Request CI
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
 
 env:
   NX_CLOUD_ENCRYPTION_KEY: ${{ secrets.NX_CLOUD_ENCRYPTION_KEY }}
@@ -14,6 +15,18 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  block-merge-label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if "Do not merge" label present
+        env:
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: |
+          if echo "$LABELS" | tr '[:upper:]' '[:lower:]' | grep -q '"do not merge"'; then
+            echo "::error::Merge blocked: PR is labeled 'do not merge'."
+            exit 1
+          fi
+
   pr:
     if: ${{github.event.pull_request.head.repo.full_name == github.repository}}
     runs-on: ubuntu-latest