Closes #2571

Summary

Added an opt-in label gate to the deploy router: when VORTEX_DEPLOY_ALLOW_LABEL is set to a label name, a pull request is deployed only if it carries that label. Without the label, the deployment is skipped cleanly with an informational note. The gate is inactive by default (empty variable) so existing deployments are unaffected. Branch and tag builds are never gated - only PR builds.

Changes

.vortex/tooling/src/deploy - Added two new variables (VORTEX_DEPLOY_ALLOW_LABEL, VORTEX_DEPLOY_PR_LABELS) and the gate logic: after the skip-list checks, if VORTEX_DEPLOY_ALLOW_LABEL is set and the build is for a PR, the script checks whether the label is present in the comma-separated VORTEX_DEPLOY_PR_LABELS list using an exact-match grep. Deployment is skipped if the label is absent; it proceeds with a confirmation note if present.

.github/workflows/build-test-deploy.yml - Wired VORTEX_DEPLOY_PR_LABELS (populated from github.event.pull_request.labels.*.name via join) and VORTEX_DEPLOY_ALLOW_LABEL (from repository variable vars.VORTEX_DEPLOY_ALLOW_LABEL) into the deploy job environment.

.vortex/installer/tests/Fixtures/ - Updated both baseline and deploy_types_none_gha fixtures to reflect the two new environment variables in the workflow.

.vortex/tooling/tests/unit/deploy.bats - Added 9 new BATS tests covering: gate inactive when variable is unset, PR carries the label (proceeds), PR lacks the label (skipped), non-PR builds unaffected, label among multiple labels, skip-list takes precedence over gate, empty label list, partial-match rejection, and labels containing spaces.

.vortex/docs/ - Added a "Gating deployments on a PR label" section to the deployment README and registered VORTEX_DEPLOY_ALLOW_LABEL in the CI variables reference and the auto-generated variables table.

Before / After

Before (skip-list only):
┌──────────────────────┐
│  Deploy called       │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐   yes  ┌─────────────────┐
│ In skip list?        ├───────►│ Skip deployment  │
└──────────┬───────────┘        └─────────────────┘
           │ no
           ▼
┌──────────────────────┐
│ Run deployment       │
└──────────────────────┘

After (skip-list + label gate):
┌──────────────────────┐
│  Deploy called       │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐   yes  ┌─────────────────┐
│ In skip list?        ├───────►│ Skip deployment  │
└──────────┬───────────┘        └─────────────────┘
           │ no
           ▼
┌──────────────────────┐   no   ┌─────────────────┐
│ ALLOW_LABEL set AND  ├───────►│ Run deployment   │
│ this is a PR build?  │        └─────────────────┘
└──────────┬───────────┘
           │ yes
           ▼
┌──────────────────────┐   no   ┌─────────────────┐
│ PR carries the label?├───────►│ Skip deployment  │
└──────────┬───────────┘        └─────────────────┘
           │ yes
           ▼
┌──────────────────────┐
│ Run deployment       │
└──────────────────────┘

Summary by CodeRabbit

Release Notes

• New Features

  • Added opt-in label-based gating for pull request deployments. PRs are now deployed only when they carry a specified authorization label.
  • PR labels are automatically detected and passed to deployment logic.

• Documentation

  • Added deployment gating configuration guide.
  • Documented new label authorization variable with default values.

• Tests

  • Added comprehensive unit tests for label-gate behavior, including edge cases and skip-list precedence.