ci(e2e): start e2e on the safe-to-e2e label and run it in the merge queue

.github/workflows/e2eci.yaml

@@ -2,37 +2,43 @@ name: e2eci
 
 on:
   pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
 
+# Labels other than safe-to-e2e get a group of their own, so they never cancel a running e2e.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}${{ github.event.action == 'labeled' && github.event.label.name != 'safe-to-e2e' && format('-{0}', github.run_id) || '' }}
   cancel-in-progress: true
 
 jobs:
   changes:
+    if: github.event.action != 'labeled' || github.event.label.name == 'safe-to-e2e'
     runs-on: ubuntu-latest
     outputs:
       e2e: ${{ steps.changes.outputs.e2e }}
     steps:
-      - name: merge-queue-pass
-        if: github.event_name == 'merge_group'
-        run: echo "::notice::Merge queue run. E2E already gated the PR, so the required e2e check auto-passes."
       - name: changes
         id: changes
-        if: github.event_name == 'pull_request'
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
-          FORCE: ${{ contains(github.event.pull_request.labels.*.name, 'safe-to-e2e') }}
+          FORCE: ${{ github.event_name == 'merge_group' || contains(github.event.pull_request.labels.*.name, 'safe-to-e2e') }}
         run: |
+          if [ "$FORCE" = "true" ]; then
+            echo "e2e=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           CHANGED_FILES=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename | select((startswith("tests/integration/") or startswith("frontend/src/api/generated/")) | not)')
           PATTERN='^(frontend/|tests/|\.github/workflows/e2eci\.yaml$|cmd/enterprise/Dockerfile\.with-web\.integration$)'
 
-          if [ "$FORCE" = "true" ]; then
-            echo "e2e=true" >> "$GITHUB_OUTPUT"
-          elif printf '%s\n' "$CHANGED_FILES" | grep -qE "$PATTERN"; then
+          if printf '%s\n' "$CHANGED_FILES" | grep -qE "$PATTERN"; then
             echo "e2e=true" >> "$GITHUB_OUTPUT"
           else
             echo "e2e=false" >> "$GITHUB_OUTPUT"
@@ -41,6 +47,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.e2e == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -180,6 +187,8 @@ jobs:
           retention-days: 5
   # Required status check. Fails when e2e was needed but did not pass.
   e2e:
+    # Runs for other labels must not report as e2e, or their pass would hide the real result.
+    name: ${{ github.event.action == 'labeled' && github.event.label.name != 'safe-to-e2e' && 'ignored-label' || 'e2e' }}
     if: always()
     needs: [changes, fmtlint, test]
     runs-on: ubuntu-latest