ci: add a merge guard check for the do-not-merge label

[caitlon]

Problem

A pull request that must not merge yet has no visible marker beyond a comment, and the do-not-merge label does nothing on its own.

Change

A Merge guard check fails while the do-not-merge label is on. .github/workflows/merge-guard.yml runs on pull requests into dev, test and prod, on opened, reopened, synchronize, labeled and unlabeled. It reads the label list from the event payload through env and jq, checks nothing out and holds an empty token. An unreadable list fails the job instead of passing it.

It is a workflow of its own. Adding the label events to ci.yml would rerun lint, tests, end-to-end and SonarCloud at every label click. This job takes seconds and starts nothing else.

The CI section of docs/environments.md lists it. The same edit corrects the sentence above it: dev requires Check already.

Verification

• uvx --from actionlint-py actionlint .github/workflows/merge-guard.yml: clean. The run: body executed on six label payloads: do-not-merge present exits 1, other labels and [] exit 0, null, invalid JSON and empty input exit non-zero with an annotation.
• Backend half of the push gate (ruff, bandit, mypy, detect-secrets, unit and integration tests): 3266 passed.
• Not checked: a live run on GitHub. Merge guard becomes a required check on dev after this merges, and the label blocks a merge from then on.

Migrations

None.

Screenshots

None.

[greptile-apps]

Automatic reviews are disabled for this repository.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud