test(terraform-isolation): lock the ci.yaml label-event contract

scripts/check-terraform-isolation.test.mjs

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import path from "node:path";
 import { test } from "node:test";
 import { fileURLToPath } from "node:url";
@@ -140,3 +141,25 @@ test("CLI refuses to run without a base ref or --stdin", () => {
   const result = spawnSync(process.execPath, [SCRIPT], { encoding: "utf8" });
   assert.notEqual(result.status, 0);
 });
+
+test("ci.yaml re-evaluates isolation on labeled and unlabeled and skips other jobs", () => {
+  const yaml = readFileSync(
+    path.join(path.dirname(fileURLToPath(import.meta.url)), "..", ".github/workflows/ci.yaml"),
+    "utf8",
+  );
+  for (const eventType of ["opened", "synchronize", "reopened", "labeled", "unlabeled"]) {
+    assert.match(yaml, new RegExp(`^      - ${eventType}$`, "m"), eventType);
+  }
+
+  const skipLabelEvents =
+    /^    if: github\.event_name != 'pull_request' \|\| \(github\.event\.action != 'labeled' && github\.event\.action != 'unlabeled'\)$/gm;
+  assert.equal(
+    [...yaml.matchAll(skipLabelEvents)].length,
+    3,
+    "build-and-test, governance, and visual-regression skip label events",
+  );
+
+  const isolation = yaml.split(/^  terraform-isolation:\n/m)[1]?.split(/^  [a-z]/m)[0] ?? "";
+  assert.match(isolation, /if: github\.event_name == 'pull_request'/);
+  assert.doesNotMatch(isolation, /if: github\.event\.action != 'labeled'/);
+});