Rebuild workflows

.github/workflows/__all-platform-bundle.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -61,7 +66,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: All-platform bundle
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__analysis-kinds.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -59,7 +64,9 @@ jobs:
             version: nightly-latest
             analysis-kinds: risk-assessment
     name: Analysis kinds
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__analyze-ref-input.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -57,7 +62,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: "Analyze: 'ref' and 'sha' from inputs"
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__autobuild-action.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -51,7 +56,9 @@ jobs:
           - os: windows-latest
             version: linked
     name: autobuild-action
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__autobuild-direct-tracing-with-working-dir.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -53,7 +58,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Autobuild direct tracing (custom working directory)
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__autobuild-working-dir.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Autobuild working directory
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__build-mode-autobuild.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -53,7 +58,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Build mode autobuild
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__build-mode-manual.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -57,7 +62,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode manual
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__build-mode-none.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -39,7 +44,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode none
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__build-mode-rollback.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Build mode rollback
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__bundle-from-nightly.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: 'Bundle: From nightly'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__bundle-from-toolcache.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: toolcache
     name: 'Bundle: From toolcache'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__bundle-toolcache.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: windows-latest
             version: linked
     name: 'Bundle: Caching checks'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__cleanup-db-cluster-dir.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Clean up database cluster directory
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__config-export.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -39,7 +44,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Config export
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__config-input.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Config input
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__cpp-deptrace-disabled.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'C/C++: disabling autoinstalling dependencies (Linux)'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__cpp-deptrace-enabled-on-macos.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -39,7 +44,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__cpp-deptrace-enabled.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'C/C++: autoinstalling dependencies (Linux)'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__diagnostics-export.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -39,7 +44,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Diagnostic export
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__export-file-baseline-information.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -61,7 +66,9 @@ jobs:
           - os: windows-latest
             version: nightly-latest
     name: Export file baseline information
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__extractor-ram-threads.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Extractor ram and threads options test
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__global-proxy.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -39,7 +44,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Proxy test
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-custom-queries.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -59,7 +64,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Go: Custom queries'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: diagnostic when Go is changed after init step'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: diagnostic when `file` is not installed'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: 'Go: workaround for indirect tracing'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-tracing-autobuilder.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -67,7 +72,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with autobuilder step'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -67,7 +72,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with custom build steps'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -67,7 +72,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: 'Go: tracing with legacy workflow'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__init-with-registries.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Download using registries'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       packages: read

.github/workflows/__javascript-source-root.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Custom source root
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__job-run-uuid-sarif.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Job run UUID added to SARIF
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__language-aliases.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Language aliases
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__linux-arm64.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -57,7 +62,9 @@ jobs:
           - os: ubuntu-24.04-arm
             version: nightly-latest
     name: Linux Arm64
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__local-bundle.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -57,7 +62,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Local CodeQL bundle
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__multi-language-autodetect.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -91,7 +96,9 @@ jobs:
           - os: macos-latest-xlarge
             version: nightly-latest
     name: Multi-language repository
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__overlay-init-fallback.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -39,7 +44,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Overlay database init fallback
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -61,7 +66,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__packaging-config-inputs-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -61,7 +66,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Config and input'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__packaging-config-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -61,7 +66,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Config file'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__packaging-inputs-js.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -61,7 +66,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: 'Packaging: Action input'
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__per-language-bundle-validation.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -72,7 +77,9 @@ jobs:
             version: nightly-latest
             build-mode: autobuild
     name: Per-language bundles
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__remote-config.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -59,7 +64,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Remote config file
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__resolve-environment-action.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Resolve environment
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__rubocop-multi-language.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__ruby.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -47,7 +52,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Ruby analysis
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__rust.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -45,7 +50,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Rust analysis
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__split-workflow.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -67,7 +72,9 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Split workflow
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__start-proxy.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: windows-latest
             version: linked
     name: Start proxy
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__submit-sarif-failure.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -41,7 +46,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Submit SARIF after failure
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: write

.github/workflows/__swift-autobuild.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -37,7 +42,9 @@ jobs:
           - os: macos-latest-xlarge
             version: nightly-latest
     name: Swift analysis using autobuild
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__swift-custom-build.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -61,7 +66,9 @@ jobs:
           - os: macos-latest-xlarge
             version: nightly-latest
     name: Swift analysis using a custom build command
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__unset-environment.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -59,7 +64,9 @@ jobs:
           - os: ubuntu-latest
             version: nightly-latest
     name: Test unsetting environment variables
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__upload-ref-sha-input.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -57,7 +62,9 @@ jobs:
           - os: ubuntu-latest
             version: default
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__upload-sarif.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -64,7 +69,9 @@ jobs:
             version: default
             analysis-kinds: code-scanning,code-quality
     name: Test different uses of `upload-sarif`
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/__with-checkout-path.yml

@@ -12,7 +12,12 @@ on:
     branches:
       - main
       - releases/v*
-  pull_request: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
   merge_group:
     types:
       - checks_requested
@@ -57,7 +62,9 @@ jobs:
           - os: ubuntu-latest
             version: linked
     name: Use a custom `checkout_path`
-    if: github.triggering_actor != 'dependabot[bot]'
+    if: |-
+      (github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||
+      github.event.label.name == 'Rebuild: Unchanged'
     permissions:
       contents: read
       security-events: read

.github/workflows/rebuild.yml

@@ -33,7 +33,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Remove label
         if: github.event_name == 'pull_request'
@@ -140,3 +140,14 @@ jobs:
           echo "Pushed a commit to rebuild the Action." \
             "Please approve running the PR checks." |
             gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
+
+      - name: "Add 'Rebuild: Unchanged' label"
+        if: >-
+          github.event_name == 'pull_request' &&
+          steps.push.outputs.changes != 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit --repo github/codeql-action "$PR_NUMBER" \
+            --add-label "Rebuild: Unchanged"

pr-checks/sync.ts

@@ -508,6 +508,17 @@ function getSetupSteps(checkSpecification: JobSpecification): {
   return { inputs: unionAll(inputs), steps };
 }
 
+/**
+ * Condition used to prevent jobs from running for Dependabot PRs
+ * to avoid unnecessary runs if the "Rebuild" workflow ends up
+ * changing the JavaScript bundles.
+ *
+ * Also allows jobs to run if a PR was labelled with "Rebuild: Unchanged".
+ */
+const jobRunCheck = new yaml.Scalar(
+  "(github.event.action != 'labeled' && github.triggering_actor != 'dependabot[bot]') ||\ngithub.event.label.name == 'Rebuild: Unchanged'",
+);
+
 /**
  * Generates an Actions job from the `checkSpecification`.
  *
@@ -578,7 +589,7 @@ function generateJob(
       },
     },
     name: checkSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if: jobRunCheck,
     permissions: {
       contents: "read",
       "security-events": "read",
@@ -628,7 +639,7 @@ function generateValidationJob(
 
   const validationJob: Record<string, any> = {
     name: jobSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if: jobRunCheck,
     needs: [checkName],
     permissions: {
       contents: "read",
@@ -771,7 +782,9 @@ function main(): void {
         push: {
           branches: ["main", "releases/v*"],
         },
-        pull_request: {},
+        pull_request: {
+          types: ["opened", "synchronize", "reopened", "labeled"],
+        },
         merge_group: {
           types: ["checks_requested"],
         },