ci: add label-gated staged CI for integration pull requests

.bazelrc

@@ -27,22 +27,18 @@ build --tool_java_language_version=17
 build --java_runtime_version=remotejdk_17
 build --tool_java_runtime_version=remotejdk_17
 
-build:_common --@score_baselibs//score/json:base_library=nlohmann
-build:_common --@score_communication//score/memory/shared/flags:use_typedshmd=False
-build:_common --@score_baselibs//score/log_rust:safety_level=qm
-build:_common --@score_config_management//score/config_management/config_daemon/code:score_variant=true
-build:_common --@score_baselibs//score/analysis/tracing/generic_trace_library:implementation=@score_baselibs//score/analysis/tracing/generic_trace_library/stub_implementation
 build:_common --cxxopt=-Wno-error=mismatched-new-delete
 build:_common --host_platform=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
 build:_common --extra_toolchains=@score_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
 build:_common --extra_toolchains=//bazel/toolchains:score_ref_int_libclang_toolchain
 
-# Flags needed by datarouter
-build:_common --@score_logging//score/datarouter/build_configuration_flags:enable_nonverbose_dlt=False
-build:_common --@score_logging//score/datarouter/build_configuration_flags:enable_dynamic_configuration=False
-build:_common --@score_logging//score/datarouter/build_configuration_flags:file_transfer=False
-build:_common --@score_logging//score/datarouter/build_configuration_flags:use_local_vlan=True
-build:_common --@score_logging//score/datarouter/build_configuration_flags:dlt_output_enable=True
+# Module-specific flags (--@score_<module>//...) do NOT belong in this file: they can
+# only be resolved while that module is part of the integration, so a module disabled
+# in known_good.json would leave a flag naming an absent repository behind and break
+# every bazel invocation, including 'bazel query'. They live in
+# bazel_common/bazelrc/<module>.bazelrc instead; the file imported below is generated
+# from known_good.json and pulls in only the enabled modules' fragments.
+import %workspace%/bazel_common/module_flags.bazelrc
 
 # ─── QNX common flags (shared by all QNX configs) ────────────────────────────
 build:_qnx_common --host_platform=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
@@ -99,10 +95,9 @@ test:ferrocene-coverage --run_under=@score_tooling//coverage:llvm_profile_wrappe
 build:ferrocene-coverage --remote_download_all
 
 # Persistency specific flags
+# The module-specific --@score_baselibs//... and --@score_logging//... flags of this
+# config live in bazel_common/bazelrc/{score_baselibs,score_logging}.bazelrc.
 build:ferrocene-coverage-per --config=ferrocene-coverage
-build:ferrocene-coverage-per --@score_baselibs//score/log_rust:safety_level=qm
-build:ferrocene-coverage-per --@score_baselibs//score/json:base_library=nlohmann
-build:ferrocene-coverage-per --@score_logging//score/mw/log/flags:KRemote_Logging=False
 
 # Output only failed test logs
 test --test_output=errors

.github/workflows/build_and_test_autosd.yml

@@ -13,7 +13,7 @@
 name: AutoSD - Build & Integration Test
 on:
   pull_request:
-    types: [opened, reopened, synchronize]
+    types: [opened, reopened, synchronize, labeled, unlabeled]
   merge_group:
     types: [checks_requested]
   push:
@@ -25,93 +25,95 @@
   cancel-in-progress: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
 jobs:
   build:
+    # Skipped while the 'staged-ci' label is set; see staged_ci_guard.yml.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
     strategy:
       matrix:
         platform:
           - x86_64
         include:
           - platform: x86_64
             runner: ubuntu-24.04
     name: autosd-${{ matrix.platform }}
     runs-on: ${{ matrix.runner }}
     env:
       AIB_SCRIPT_URL: https://gitlab.com/CentOS/automotive/src/automotive-image-builder/-/raw/1.3.0/auto-image-builder.sh?ref_type=tags
       AIB_CONTAINER_IMAGE: quay.io/centos-sig-automotive/automotive-image-builder:1.3.0
     steps:
       - name: Clean disk space
         uses: eclipse-score/more-disk-space@v1
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Setup Bazel
         uses: bazel-contrib/setup-bazel@0.18.0
         with:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}
           repository-cache: true
           cache-save: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
       - name: Shows kernel version
         run: |
           uname -a
       - name: Install System Dependencies
         run: |
           sudo apt-get update -y
           sudo apt-get install -y podman curl qemu-system createrepo-c tree
       - name: Build and Export Showcases OCI Image
         run: |
           bazel run --announce_rc --lockfile_mode=error --config autosd-${{ matrix.platform }} //images/autosd:image_load
 
           tree bazel-bin
       - name: Export OCI Archive
         run: |
           sudo podman run -it --rm \
           -v /var/run/docker.sock:/var/run/docker.sock \
           -v $PWD/images/autosd:/outputs \
           docker://quay.io/skopeo/stable:latest copy \
           docker-daemon:score_showcases_autosd:latest \
           oci-archive:/outputs/score_showcases_autosd_latest.oci
 
           sudo chown -R $(id -u):$(id -u) images/autosd/
 
           stat images/autosd/score_showcases_autosd_latest.oci
       - name: Download AutoSD Image
         run: |
           wget \
           -L --tries=10 --retry-connrefused --waitretry=5 \
           -O disk.qcow2.xz \
           https://github.com/eclipse-autosd/eclipse-autosd/releases/download/dev/eclipse-autosd-bootc-qemu-${{ matrix.platform }}.qcow2.xz
 
           xz -d disk.qcow2.xz
         working-directory: ./images/autosd
       - name: Enable KVM group perms
         run: |
           echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
           sudo udevadm control --reload-rules
           sudo udevadm trigger --name-match=kvm
       - name: Test QEMU image
         run: |
           sshcmd() {
             sshpass -p "$SSH_PASSWORD" \
             ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
             -p 2222 root@localhost \
             $@
           }
 
           scpcmd() {
             sshpass -p "$SSH_PASSWORD" scp \
             -o StrictHostKeyChecking=no \
             -o UserKnownHostsFile=/dev/null \
             -P 2222 \
             $@
           }
 
           QEMU_ARCH=${{ matrix.platform }} ./scripts/run_qemu
 
           sshcmd 'cat /etc/os-release'
           scpcmd './score_showcases_autosd_latest.oci root@localhost:/tmp/score_showcases_autosd_latest.oci'
           sshcmd 'bootc switch --apply  --transport oci-archive /tmp/score_showcases_autosd_latest.oci' || true
           sleep 5
           sshcmd 'bootc status'
           sshcmd '/showcases/bin/cli --examples all'
         working-directory: ./images/autosd
         env:
           SSH_PASSWORD: password

.github/workflows/build_and_test_ebclfsa.yml

@@ -13,7 +13,7 @@
 name: EB corbos Linux for Safety Applications - Build & Integration Test
 on:
   pull_request:
-    types: [opened, reopened, synchronize]
+    types: [opened, reopened, synchronize, labeled, unlabeled]
   merge_group:
     types: [checks_requested]
   push:
@@ -26,6 +26,8 @@ concurrency:
 jobs:
   build:
     name: aarch64
+    # Skipped while the 'staged-ci' label is set; see staged_ci_guard.yml.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
     runs-on: ubuntu-latest
     container:
       image: ghcr.io/eclipse-score/devcontainer:v1.11.0

.github/workflows/build_and_test_linux.yml

@@ -14,6 +14,7 @@ name: Linux - Build & Integration Test
 on:
   workflow_dispatch:
   pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
   release:
     types: [created]
   push:
@@ -25,6 +26,8 @@ concurrency:
   cancel-in-progress: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
 jobs:
   x86_64:
+    # Skipped while the 'staged-ci' label is set; see staged_ci_guard.yml.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
     runs-on: ubuntu-latest
     permissions:
       contents: write # required to upload release assets

.github/workflows/build_and_test_qnx.yml

@@ -13,7 +13,7 @@
 name: QNX8 - Build & Integration Test
 on:
   pull_request_target:
-    types: [opened, reopened, synchronize]
+    types: [opened, reopened, synchronize, labeled, unlabeled]
   merge_group:
     types: [checks_requested]
   push:
@@ -26,6 +26,8 @@ concurrency:
 jobs:
   qnx-build-x86_64:
     name: x86_64
+    # Skipped while the 'staged-ci' label is set; see staged_ci_guard.yml.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
     runs-on: ${{ vars.REPO_RUNNER_LABELS && fromJSON(vars.REPO_RUNNER_LABELS) || 'ubuntu-latest' }}
     environment: ${{ inputs.environment-name }}
     permissions:

.github/workflows/codeql-multiple-repo-scan.yml

@@ -13,7 +13,7 @@
 name: "CodeQL - Multi-Repo Source Scan"
 on:
   pull_request:
-    types: [opened, reopened, synchronize]
+    types: [opened, reopened, synchronize, labeled, unlabeled]
   merge_group:
     types: [checks_requested]
   push:
@@ -31,6 +31,8 @@ concurrency:
 jobs:
   analyze-repos:
     name: Analyze Multiple Repositories
+    # Skipped while the 'staged-ci' label is set; see staged_ci_guard.yml.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
     runs-on: ubuntu-latest
     timeout-minutes: 120 # Prevent indefinite hanging
     permissions:

.github/workflows/known_good_correct.yml

@@ -35,3 +35,20 @@ jobs:
               git diff
               exit 1
           fi
+      # Only needed by the disabled-module check below, which resolves the real module
+      # graph. Installing bazelisk is cheap; nothing invokes Bazel unless a module is
+      # actually disabled, so an ordinary pull request pays for the setup step alone.
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}
+          repository-cache: true
+          cache-save: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+      # Dropping a module's bazel_dep does not remove it from the build: any module that
+      # declares its own dependency on it makes Bazel fall back to the registry, silently
+      # swapping the pinned commit for a released version. This resolves the real graph and
+      # fails if that happened. It exits before touching Bazel when nothing is disabled, so
+      # it costs nothing on an ordinary pull request.
+      - name: Verify disabled modules are really gone
+        run: scripts/known_good/check_disabled_modules.py --known known_good.json

.github/workflows/staged_ci_guard.yml

@@ -0,0 +1,62 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+#
+# Staged CI Guard
+#
+# Companion to the 'staged-ci' label. While that label is present on a pull
+# request, the expensive platform and quality jobs skip themselves so a
+# "come together" integration PR can be validated cheaply first (module
+# resolution + documentation) before an hour of image builds is spent.
+#
+# GitHub reports a job skipped via `if:` as *skipped*, and branch protection
+# treats a skipped required check as satisfied. Without this guard a staged PR
+# would therefore be mergeable even though none of the heavy checks ever ran.
+# This job always runs and fails while the label is set, so the label must be
+# removed - and the full pipeline must pass - before a merge is possible.
+#
+# Make this check REQUIRED in the repository's branch-protection settings,
+# otherwise it does not protect anything.
+name: Staged CI Guard
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+  merge_group:
+    types: [checks_requested]
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
+jobs:
+  staged-ci-guard:
+    name: Staged CI Guard
+    runs-on: ubuntu-latest
+    steps:
+      - name: Block merge while CI is staged
+        if: contains(github.event.pull_request.labels.*.name, 'staged-ci')
+        run: |
+          {
+            echo "### :no_entry: CI is staged"
+            echo
+            echo "The \`staged-ci\` label is set on this pull request, so the"
+            echo "platform builds, unit tests, coverage, feature integration"
+            echo "tests and CodeQL scan were **skipped**."
+            echo
+            echo "Remove the \`staged-ci\` label to run the full pipeline."
+            echo "This check blocks the merge until then."
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "::error::The 'staged-ci' label is set - the full CI pipeline has not run. Remove the label before merging."
+          exit 1
+      - name: Confirm full pipeline is enabled
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
+        run: echo "No 'staged-ci' label - the full CI pipeline runs for this change."

.github/workflows/test_and_docs.yml

@@ -18,7 +18,7 @@ permissions:
   id-token: write
 on:
   pull_request_target: # Allow forks to access secrets
-    types: [opened, reopened, synchronize]
+    types: [opened, reopened, synchronize, labeled, unlabeled]
   push:
     branches:
       - main
@@ -81,6 +81,11 @@ jobs:
               --github_repo=${{ github.event.repository.name }}
           rm -rf _build/
       - name: Execute Unit Tests with Coverage Analysis
+        # Skipped while the 'staged-ci' label is set: the documentation preflight
+        # above is derived from known_good.json and answers whether the module set
+        # resolves at all, which is what an integration PR needs first. See
+        # staged_ci_guard.yml.
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
         # Only tag runs are authoritative and re-execute every test from scratch, because they
         # attach the test-report ZIP and the SBOM as official release assets. The condition is
         # deliberately the same one those upload steps use, so the two can never drift apart.
@@ -92,6 +97,8 @@ jobs:
           python ./scripts/quality_runners.py \
             ${{ github.ref_type != 'tag' && '--trust-cache' || '' }}
       - name: Execute Feature Integration Tests
+        # Skipped while the 'staged-ci' label is set; see staged_ci_guard.yml.
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'staged-ci') }}
         run: |
           bazel test --config=linux-x86_64 //feature_integration_tests/test_cases:fit
       - name: Install uv (required for SBOM license scanning)

bazel_common/bazelrc/score_baselibs.bazelrc

@@ -0,0 +1,23 @@
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# Module-specific Bazel flags for score_baselibs.
+#
+# These flags name labels inside @score_baselibs, so they can only be resolved while
+# that module is part of the integration. Keeping them here rather than in the root
+# .bazelrc means they disappear together with the module when it is disabled in
+# known_good.json - a --@score_baselibs//... flag for an absent module would otherwise
+# break every bazel invocation, including 'bazel query'.
+#
+# Imported via bazel_common/module_flags.bazelrc, which is generated from
+# known_good.json. Do not import this file directly.
+
+build:_common --@score_baselibs//score/json:base_library=nlohmann
+build:_common --@score_baselibs//score/log_rust:safety_level=qm
+build:_common --@score_baselibs//score/analysis/tracing/generic_trace_library:implementation=@score_baselibs//score/analysis/tracing/generic_trace_library/stub_implementation
+
+# Persistency-specific coverage config (see rust_coverage_config of score_persistency
+# in known_good.json). The flags belong to score_baselibs, so they live here.
+build:ferrocene-coverage-per --@score_baselibs//score/log_rust:safety_level=qm
+build:ferrocene-coverage-per --@score_baselibs//score/json:base_library=nlohmann

bazel_common/bazelrc/score_communication.bazelrc

@@ -0,0 +1,16 @@
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# Module-specific Bazel flags for score_communication.
+#
+# These flags name labels inside @score_communication, so they can only be resolved
+# while that module is part of the integration. Keeping them here rather than in the
+# root .bazelrc means they disappear together with the module when it is disabled in
+# known_good.json - a --@score_communication//... flag for an absent module would
+# otherwise break every bazel invocation, including 'bazel query'.
+#
+# Imported via bazel_common/module_flags.bazelrc, which is generated from
+# known_good.json. Do not import this file directly.
+
+build:_common --@score_communication//score/memory/shared/flags:use_typedshmd=False

bazel_common/bazelrc/score_config_management.bazelrc

@@ -0,0 +1,16 @@
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# Module-specific Bazel flags for score_config_management.
+#
+# These flags name labels inside @score_config_management, so they can only be
+# resolved while that module is part of the integration. Keeping them here rather than
+# in the root .bazelrc means they disappear together with the module when it is
+# disabled in known_good.json - a --@score_config_management//... flag for an absent
+# module would otherwise break every bazel invocation, including 'bazel query'.
+#
+# Imported via bazel_common/module_flags.bazelrc, which is generated from
+# known_good.json. Do not import this file directly.
+
+build:_common --@score_config_management//score/config_management/config_daemon/code:score_variant=true

bazel_common/bazelrc/score_logging.bazelrc

@@ -0,0 +1,25 @@
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# Module-specific Bazel flags for score_logging.
+#
+# These flags name labels inside @score_logging, so they can only be resolved while
+# that module is part of the integration. Keeping them here rather than in the root
+# .bazelrc means they disappear together with the module when it is disabled in
+# known_good.json - a --@score_logging//... flag for an absent module would otherwise
+# break every bazel invocation, including 'bazel query'.
+#
+# Imported via bazel_common/module_flags.bazelrc, which is generated from
+# known_good.json. Do not import this file directly.
+
+# Flags needed by datarouter
+build:_common --@score_logging//score/datarouter/build_configuration_flags:enable_nonverbose_dlt=False
+build:_common --@score_logging//score/datarouter/build_configuration_flags:enable_dynamic_configuration=False
+build:_common --@score_logging//score/datarouter/build_configuration_flags:file_transfer=False
+build:_common --@score_logging//score/datarouter/build_configuration_flags:use_local_vlan=True
+build:_common --@score_logging//score/datarouter/build_configuration_flags:dlt_output_enable=True
+
+# Persistency-specific coverage config (see rust_coverage_config of score_persistency
+# in known_good.json). The flag belongs to score_logging, so it lives here.
+build:ferrocene-coverage-per --@score_logging//score/mw/log/flags:KRemote_Logging=False

bazel_common/module_flags.bazelrc

@@ -0,0 +1,15 @@
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# Generated from known_good.json at 2026-08-28T09:19:12Z
+# Do not edit manually - use scripts/known_good/update_module_from_known_good.py
+#
+# Each line imports one enabled module's flag fragment from bazelrc/.
+# A module disabled in known_good.json is simply absent here, so its flags are gone
+# without its fragment file having to be touched.
+
+import %workspace%/bazel_common/bazelrc/score_baselibs.bazelrc
+import %workspace%/bazel_common/bazelrc/score_communication.bazelrc
+import %workspace%/bazel_common/bazelrc/score_config_management.bazelrc
+import %workspace%/bazel_common/bazelrc/score_logging.bazelrc

bazel_common/score_sbom.MODULE.bazel

@@ -10,7 +10,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
-# Generated from known_good.json at 2026-08-21T00:00:00+00:00Z
+# Generated from known_good.json at 2026-08-28T09:19:12Z
 # Do not edit manually - use scripts/known_good/update_module_from_known_good.py
 
 sbom_ext = use_extension("@score_sbom//:extensions.bzl", "sbom_metadata")