[CI] Require D*-audit labels for any runtime changes (#8345)

* add check for audit labels if runtime change

* fix shellcheck nits

* include lib.sh in check_runtime.sh

* fix check_labels.sh

* fix check_labels.sh

* oops, this is github actions...

* why wont this work

* fetch all refs

* Update check-labels.yml

* print env - wtf is happening

* checkout the PR...

* ffs

* fix

* REVERT ME: test runtime check

* Revert "REVERT ME: test runtime check"

This reverts commit 0fd2b04abeeac12dd8ede4c0708cb796f9e3e722.

substrate/.maintain/github/check_labels.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+set -e
 
 #shellcheck source=../common/lib.sh
 source "$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )/../common/lib.sh"
@@ -30,6 +31,12 @@ criticality_labels=(
   'C9-critical'
 )
 
+audit_labels=(
+  'D1-audited👍'
+  'D5-nicetohaveaudit⚠️'
+  'D9-needsaudit👮'
+)
+
 echo "[+] Checking release notes (B) labels"
 if ensure_labels "${releasenotes_labels[@]}";  then
   echo "[+] Release notes label detected. All is well."
@@ -46,4 +53,14 @@ else
   exit 1
 fi
 
+if has_runtime_changes origin/master "${HEAD_SHA}"; then
+  echo "[+] Runtime changes detected. Checking audit (D) labels"
+  if ensure_labels "${audit_labels[@]}";  then
+    echo "[+] Release audit label detected. All is well."
+  else
+    echo "[!] Release audit label not detected. Please add one of: ${audit_labels[*]}"
+    exit 1
+  fi
+fi
+
 exit 0