fix: skip stale run-ci label check on workflow re-runs (#26590)

* fix: trust community PRs when maintainer pushes to the branch

When a maintainer merges main into a community PR branch, the new SHA
invalidates the run-ci label timing check because the label was added
before the new push. This fix adds a check to trust the PR if the
person who pushed the latest commit has write access.

This handles the case where a maintainer:
- Merges main into a community PR to resolve conflicts
- Pushes any changes to help the contributor

The security model is maintained because:
- Only users with write access can trigger this trust
- The maintainer has reviewed the code by pushing to it

Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>

* fix: skip stale label check on workflow re-runs

Instead of implicitly trusting maintainer pushes (which could be just
a sync action without code review), use github.run_attempt to detect
re-runs. If run_attempt > 1, it means the workflow was explicitly
re-triggered (via run-ci.yml or manual re-run), so we skip the stale
label check.

This avoids the need to remove and re-add the 'run-ci' label after
syncing a community PR with main, while keeping the explicit approval
flow intact.

Co-Authored-By: anik@cal.com <adhabal2002@gmail.com>

* Simplify comment about re-runs in PR workflow

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Keith Williams <keithwillcode@gmail.com>

.github/workflows/pr.yml

@@ -97,6 +97,15 @@ jobs:
             // NOTE: We use workflow run created_at instead of commit timestamp because
             // git commit timestamps can be arbitrarily backdated by attackers
             if (pr.labels?.some(l => l.name === 'run-ci')) {
+              // Skip stale check if this is a re-run (run_attempt > 1)
+              // Re-runs are explicitly triggered by maintainers
+              const runAttempt = parseInt(process.env.GITHUB_RUN_ATTEMPT || '1', 10);
+              if (runAttempt > 1) {
+                console.log(`Re-run detected (attempt ${runAttempt}), trusting existing 'run-ci' label`);
+                core.setOutput('is-trusted', true);
+                return;
+              }
+
               const events = await github.paginate(github.rest.issues.listEvents, {
                 owner,
                 repo,