ci: fail a pull request that waits for an unmerged gitea change

.gitea/workflows/depends_upstream.yaml

@@ -0,0 +1,46 @@
+# The status check context of this job is "checks / depends-upstream
+# (pull_request)", which the required status check `checks / *` of the protected
+# main branch matches, so a pull request waiting for gitea cannot be merged.
+# It is a workflow of its own so that a label change does not cancel the build
+# and the preview deployment of the `checks` workflow in test.yaml.
+name: checks
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - edited
+      - labeled
+      - unlabeled
+
+concurrency:
+  group: depends-upstream-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  depends-upstream:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # the check script is taken from the base branch: a pull request must
+          # not be able to weaken its own gate
+          ref: ${{ github.event.pull_request.base.ref }}
+          persist-credentials: false
+      - name: check the upstream dependencies
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          # optional, only lifts the rate limit of the unauthenticated github api
+          GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          # read the description and the labels from the api instead of the
+          # event context, so nothing from a pull request body is expanded into
+          # this script
+          api="${GITHUB_API_URL:-$GITHUB_SERVER_URL/api/v1}/repos/$GITHUB_REPOSITORY"
+          curl --silent --show-error --fail --output pull.json "$api/pulls/$PR_NUMBER"
+
+          ./scripts/check-upstream-deps.sh pull.json