feat: limit ci resources (#4982)

Once this lands; PRs will need to have a "labeled" event for `CICD` to
trigger tests. This will only run for the HEAD sha at the time of
labelling - so further pushes will required removing and re-adding the
CICD label.

---------

Signed-off-by: John McDole <codefu@google.com>

Author: jtmcdole

app_dart/lib/src/model/github/labels.dart

@@ -0,0 +1,63 @@
+// Copyright 2026 The Flutter Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import 'dart:convert';
+
+import 'package:json_annotation/json_annotation.dart';
+
+part 'labels.g.dart';
+
+@JsonSerializable(fieldRename: FieldRename.snake)
+class LabeledEvent {
+  LabeledEvent({required this.label});
+  factory LabeledEvent.fromJson(Map<String, Object?> input) =>
+      _$LabeledEventFromJson(input);
+
+  final Label label;
+
+  Map<String, Object?> toJson() => _$LabeledEventToJson(this);
+
+  @override
+  String toString() {
+    return '$LabeledEvent ${const JsonEncoder.withIndent('  ').convert(toJson())}';
+  }
+}
+
+@JsonSerializable(fieldRename: FieldRename.snake)
+class Label {
+  Label({
+    required this.id,
+    required this.name,
+    required this.nodeId,
+    required this.url,
+    required this.color,
+    required this.description,
+  });
+  factory Label.fromJson(Map<String, Object?> input) => _$LabelFromJson(input);
+
+  /// id: 4232992339
+  final int id;
+
+  /// name: autosubmit
+  final String name;
+
+  /// node_id: LA_kwDOAeUeuM78TlZT
+  final String nodeId;
+
+  /// url: https://api.github.com/repos/flutter/flutter/labels/autosubmit
+  final Uri url;
+
+  /// color: 008820
+  final String color;
+
+  // description: Merge PR when tree becomes green via auto submit App
+  final String description;
+
+  Map<String, Object?> toJson() => _$LabelToJson(this);
+
+  @override
+  String toString() {
+    return '$Label ${const JsonEncoder.withIndent('  ').convert(toJson())}';
+  }
+}

app_dart/lib/src/model/github/labels.g.dart

@@ -15,6 +15,7 @@ import 'package:meta/meta.dart';
 import '../../../cocoon_service.dart';
 import '../../../protos.dart' as pb;
 import '../../model/github/checks.dart' as cocoon_checks;
+import '../../model/github/labels.dart';
 import '../../model/github/workflow_job.dart' as workflow_job;
 import '../../request_handling/exceptions.dart';
 import '../../request_handling/subscription_handler.dart';
@@ -199,17 +200,9 @@ final class GithubWebhookSubscription extends SubscriptionHandler {
         return result.toResponse();
       case 'edited':
         await _checkForTests(pullRequestEvent);
-        // In the event of the base ref changing we want to start new checks.
-        if (pullRequestEvent.changes != null &&
-            pullRequestEvent.changes!.base != null) {
-          await _scheduleIfMergeable(pullRequestEvent);
-        }
         break;
       case 'opened':
-        // These cases should trigger LUCI jobs. The closed event should happen
-        // before these which should cancel all in progress checks.
         await _checkForTests(pullRequestEvent);
-        await _scheduleIfMergeable(pullRequestEvent);
         await _tryReleaseApproval(pullRequestEvent);
         break;
       case 'reopened':
@@ -220,18 +213,25 @@ final class GithubWebhookSubscription extends SubscriptionHandler {
         log.info(
           '$crumb: PR labels = [${pr.labels?.map((label) => '"${label.name}"').join(', ')}]',
         );
+
+        final labelEvent = _getLabeledEvent(rawRequest);
+        if (labelEvent?.label case final label?) {
+          if (Config.kCicdLabelIds.contains(label.id) &&
+              label.name == Config.kCicdLabel) {
+            log.info('new CICD label added - scheduling tests');
+            await _scheduleIfMergeable(pullRequestEvent);
+          }
+        }
+
         await _processLabels(pr);
         await _updatePullRequest(pr);
-        break;
-      case 'synchronize':
-        // This indicates the PR has new commits. We need to cancel old jobs
-        // and schedule new ones.
-        await _scheduleIfMergeable(pullRequestEvent);
+
         break;
       case 'dequeued':
         await _respondToPullRequestDequeued(pullRequestEvent);
         break;
       // Ignore the rest of the events.
+      case 'synchronize':
       case 'ready_for_review':
       case 'unlabeled':
       case 'assigned':
@@ -967,6 +967,17 @@ final class GithubWebhookSubscription extends SubscriptionHandler {
     }
   }
 
+  LabeledEvent? _getLabeledEvent(String request) {
+    try {
+      return LabeledEvent.fromJson(
+        json.decode(request) as Map<String, dynamic>,
+      );
+    } catch (e, s) {
+      log.warn('_getLabeledEvent: Failed to parse $request', e, s);
+      return null;
+    }
+  }
+
   /// Returns true if the changes to [file] are all code comments.
   ///
   /// If that cannot be determined with confidence, returns false. False

app_dart/lib/src/request_handlers/github/webhook_subscription.dart

@@ -4,6 +4,9 @@
 
 import 'dart:async';
 
+// ignore: unused_import
+import 'package:cocoon_server/logging.dart';
+// ignore: unused_import
 import 'package:github/github.dart';
 import 'package:meta/meta.dart';
 
@@ -20,6 +23,7 @@ final class ResetTryTask extends ApiRequestHandler {
     required Scheduler scheduler,
   }) : _scheduler = scheduler;
 
+  // ignore: unused_field
   final Scheduler _scheduler;
 
   @visibleForTesting
@@ -40,25 +44,27 @@ final class ResetTryTask extends ApiRequestHandler {
       kRepoParam,
       kPullRequestNumberParam,
     ]);
-    final owner = request.uri.queryParameters[kOwnerParam] ?? 'flutter';
-    final repo = request.uri.queryParameters[kRepoParam]!;
+    // final owner = request.uri.queryParameters[kOwnerParam] ?? 'flutter';
+    // final repo = request.uri.queryParameters[kRepoParam]!;
     final pr = request.uri.queryParameters[kPullRequestNumberParam]!;
-    final builders = request.uri.queryParameters[kBuilderParam] ?? '';
-    final builderList = getBuilderList(builders);
+    // final builders = request.uri.queryParameters[kBuilderParam] ?? '';
+    // final builderList = getBuilderList(builders);
 
     final prNumber = int.tryParse(pr);
     if (prNumber == null) {
       throw const BadRequestException(
         '$kPullRequestNumberParam must be a number',
       );
     }
-    final slug = RepositorySlug(owner, repo);
-    final github = await config.createGitHubClient(slug: slug);
-    final pullRequest = await github.pullRequests.get(slug, prNumber);
-    await _scheduler.triggerPresubmitTargets(
-      pullRequest: pullRequest,
-      builderTriggerList: builderList,
-    );
+    // final slug = RepositorySlug(owner, repo);
+    // final github = await config.createGitHubClient(slug: slug);
+    // final pullRequest = await github.pullRequests.get(slug, prNumber);
+
+    // WARNING: Did you need this? If so, reach out to codefu.
+    // await _scheduler.triggerPresubmitTargets(
+    //   pullRequest: pullRequest,
+    //   builderTriggerList: builderList,
+    // );
     return Response.emptyOk;
   }
 

app_dart/lib/src/request_handlers/reset_try_task.dart

@@ -38,6 +38,18 @@ interface class Config extends DynamicallyUpdatedConfig {
   /// Keep this in sync with the similar `Config` class in `auto_submit`.
   static const String kEmergencyLabel = 'emergency';
 
+  /// Label required to schedule CI tasks on pull requests as a security stop-gap.
+  static const String kCicdLabel = 'CICD';
+
+  /// GitHub ID for the CICD label.
+  static const int kCicdLabelIdFlutter = 10404216443;
+
+  /// GitHub ID for the CICD label.
+  static const int kCicdLabelIdPackages = 10404974695;
+
+  /// All valid labels for triggering cicd
+  static const kCicdLabelIds = [kCicdLabelIdFlutter, kCicdLabelIdPackages];
+
   /// Validates that CI tasks were successfully created from the .ci.yaml file.
   ///
   /// If this check fails, it means Cocoon failed to fully populate the list of