ci: fail a pull request that waits for an unmerged gitea change

.gitea/workflows/unlabel_depends_upstream.yaml

@@ -0,0 +1,29 @@
+name: unlabel merged upstream dependencies
+
+on:
+  schedule:
+    - cron: '15 */6 * * *' # every 6 hours, quarter past
+  workflow_dispatch:
+
+jobs:
+  unlabel:
+    if: github.repository == 'gitea/docs'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: drop the label from the pull requests upstream caught up with
+        env:
+          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
+          GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DEPLOY_TOKEN:-}" ]; then
+            echo "secrets.DEPLOY_TOKEN is missing, cannot remove the label"
+            exit 1
+          fi
+
+          export GITEA_API="${GITHUB_API_URL:-$GITHUB_SERVER_URL/api/v1}/repos/$GITHUB_REPOSITORY"
+          ./scripts/unlabel-upstream-deps.sh