[CI] Add label enforcement (#6365)

* Add label enforcement

* fix .gitlab-ci.yml

* update check_labels.sh

substrate/.gitlab-ci.yml

@@ -721,3 +721,14 @@ validator 4 4:
   <<:                              *validator-deploy
   script:
     - ./.maintain/flamingfir-deploy.sh flamingfir-validator4
+
+#### stage:                       .post
+
+check-labels:
+  stage:                          .post
+  image:                          paritytech/tools:latest
+  <<:                             *kubernetes-build
+  only:
+    - /^[0-9]+$/
+  script:
+    - ./.maintain/gitlab/check_labels.sh

substrate/.maintain/gitlab/check_labels.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+#shellcheck source=lib.sh
+source "$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )/lib.sh"
+
+ensure_labels() {
+  for label in "$@"; do
+    if has_label 'paritytech/substrate' "$CI_COMMIT_BRANCH" "$label"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Must have one of the following labels
+releasenotes_labels=(
+  'B0-silent'
+  'B3-apinoteworthy'
+  'B5-clientnoteworthy'
+  'B7-runtimenoteworthy'
+)
+
+criticality_labels=(
+  'C1-low'
+  'C3-medium'
+  'C7-high'
+  'C9-critical'
+)
+
+echo "[+] Checking release notes (B) labels for $CI_COMMIT_BRANCH"
+if ensure_labels "${releasenotes_labels[@]}";  then
+  echo "[+] Release notes label detected. All is well."
+else
+  echo "[!] Release notes label not detected. Please add one of: ${releasenotes_labels[*]}"
+  exit 1
+fi
+
+echo "[+] Checking release criticality (C) labels for $CI_COMMIT_BRANCH"
+if ensure_labels "${criticality_labels[@]}";  then
+  echo "[+] Release criticality label detected. All is well."
+else
+  echo "[!] Release criticality label not detected. Please add one of: ${criticality_labels[*]}"
+  exit 1
+fi
+
+exit 0

substrate/.maintain/gitlab/lib.sh

@@ -66,8 +66,12 @@ has_label(){
   repo="$1"
   pr_id="$2"
   label="$3"
+  if [ -n "$GITHUB_RELEASE_TOKEN" ]; then
     out=$(curl -H "Authorization: token $GITHUB_RELEASE_TOKEN" -s "$api_base/$repo/pulls/$pr_id")
-  [ -n "$(echo "$out" | jq ".labels | .[] | select(.name==\"$label\")")" ]
+  else
+    out=$(curl -H "Authorization: token $GITHUB_PR_TOKEN" -s "$api_base/$repo/pulls/$pr_id")
+  fi
+  [ -n "$(echo "$out" | tr -d '\r\n' | jq ".labels | .[] | select(.name==\"$label\")")" ]
 }
 
 # Formats a message into a JSON string for posting to Matrix