cicd/bug: query live labels in hold gate instead of (stale) event payload (#2200)

* fix(ci): query live labels in hold gate instead of stale event payload

github.event.pull_request.labels is frozen at trigger time, so a manual
rerun of a failed hold-gate job kept failing after the hold label was
removed. Fetch current labels via the GitHub API instead.

Fixes #2199

Signed-off-by: Etai Lev Ran <elevran@gmail.com>

* fix(ci): move hold-gate rerun comment inline and shorten it

Signed-off-by: Etai Lev Ran <elevran@gmail.com>

* fix(ci): make hold-gate blocking labels an extensible array

Signed-off-by: Etai Lev Ran <elevran@gmail.com>

* fix(ci): report the specific blocking label found

Signed-off-by: Etai Lev Ran <elevran@gmail.com>

* fix(ci): simplify blocking-label error message

Signed-off-by: Etai Lev Ran <elevran@gmail.com>

---------

Signed-off-by: Etai Lev Ran <elevran@gmail.com>

Author: elevran

.github/workflows/pr-hold-gate.yml

@@ -1,6 +1,6 @@
-# Fails a required check while a hold label is present, so the `hold` label and
-# the release branch auto-hold (`do-not-merge/hold`) block GitHub native
-# auto-merge. Re-runs on label changes.
+# Fails a required check while a hold label is present, so /hold (label `hold`)
+# and the release-branch auto-hold (label `do-not-merge/hold`) block
+# GitHub-native auto-merge. Re-runs on label changes.
 
 name: Hold gate
 
@@ -10,13 +10,24 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   hold:
     runs-on: ubuntu-latest
     steps:
       - name: Block merge while held
-        if: contains(github.event.pull_request.labels.*.name, 'hold') || contains(github.event.pull_request.labels.*.name, 'do-not-merge/hold')
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
-          echo "::error::A hold label is present (hold or do-not-merge/hold). Remove the label to allow merge."
-          exit 1
+          blocking_labels=(hold do-not-merge/hold)
+
+          # fetch current labels
+          labels=$(gh pr view "$PR_URL" --json labels -q '.labels[].name')
+          for label in "${blocking_labels[@]}"; do
+            if grep -qxF "$label" <<< "$labels"; then
+              echo "::error::Blocking label '$label' is present. Remove it to allow merge (e.g., /hold cancel for hold)."
+              exit 1
+            fi
+          done