Add minimal prow-github-actions setup

.github/prow.yaml

@@ -0,0 +1,121 @@
+#  Copyright 2026 Google LLC
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# Adapted from https://github.com/cncf/prow-github-actions/blob/main/templates/prow.yaml
+
+labels:
+  area:
+    - name: api
+    - name: api-machinery
+    - name: benchmarking
+    - name: cli
+    - name: demos
+    - name: dev-infra
+    - name: gvisor
+    - name: identity
+    - name: microVM
+    - name: network
+    - name: node
+    - name: observability
+    - name: reliability
+    - name: scheduling
+    - name: security
+    - name: storage
+    - name: tests
+
+  kind:
+    - name: bug
+      description: Something isn't working / bugfixes
+    - name: cleanup
+      description: Small fixes that are not bugs
+    - name: design
+      description: Design discussion, investigation, or research
+    - name: docs
+      description: Improvements or additions to documentation
+    - name: feature
+      description: A feature request or implementation
+
+  # exclusive: a later /priority replaces the existing priority/* label
+  priority:
+    values:
+      - name: P0
+        color: e11d21
+        description: Critical, Required for next milestone
+      - name: P1
+        color: eb6420
+        description: Important, but not critical
+      - name: P2
+        color: eb6420
+        description: Real, but not urgent
+    exclusive: true
+
+
+  # the built-in /lifecycle values, spelled out so their labels are created too
+  lifecycle:
+    values:
+      - name: frozen
+        color: d3e2f0
+        description: Indicates that an issue or PR should not be auto-closed due to staleness.
+      - name: stale
+        color: '795548'
+        description: Denotes an issue or PR has remained open with no activity and has become stale.
+      - name: rotten
+        color: '604460'
+        description: Denotes an issue or PR that has aged beyond stale and will be auto-closed.
+    exclusive: true
+
+  # the merge gate's deny list; /hold applies do-not-merge/hold
+  do-not-merge:
+    - name: hold
+      color: e11d21
+      description: Indicates that a PR should not merge because someone has issued a /hold command.
+    - name: work-in-progress
+      color: e11d21
+      description: Indicates that a PR should not merge because it is a work in progress.
+    - name: invalid-owners-file
+      color: e11d21
+      description: Indicates that a PR should not merge because it has an invalid OWNERS file in it.
+
+# needs-* labels until a matching label is applied; needs-* labels are colored ededed
+require_matching_label:
+  - regexp: ^kind/
+    missing_label: needs-kind
+    issues: true
+    prs: true
+    missing_comment: Please add a kind label with /kind <value>.
+  - regexp: ^triage/
+    missing_label: needs-triage
+    issues: true
+    prs: false
+  - regexp: ^area/
+    missing_label: needs-area
+    issues: true
+    prs: true
+
+# the merge gate; these are the defaults
+tide:
+  labels: [lgtm]
+  missing_labels: [do-not-merge/*, needs-rebase, hold]
+  merge_method: merge
+  merge_on_events: true
+
+# the label /hold applies; this is the default
+hold:
+  label: do-not-merge/hold
+
+# reviewers requested from OWNERS files when a pull request opens
+blunderbuss:
+  request_count: 2
+  ignore_drafts: true
+  ignore_authors: ['dependabot[bot]']

.github/workflows/pr-workflow.yaml

@@ -12,30 +12,32 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
+# Adapted from https://github.com/cncf/prow-github-actions/blob/main/templates/workflow-templates/prow.yml
+
 name: pr-workflow
 on:
   pull_request:
 jobs:
   run-tests:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
       uses: actions/checkout@v3
     - name: Setup Go
       uses: actions/setup-go@v5
       with:
         go-version: 1.26
     - run: go vet -v ./...
     - run: go test -v ./...
     - name: verify
       run: hack/verify-all.sh
   e2e-test:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
       uses: actions/checkout@v3
     - name: Setup Go
       uses: actions/setup-go@v5
       with:
         go-version: 1.26
     - name: Install kind

.github/workflows/prow.yaml

@@ -0,0 +1,87 @@
+#  Copyright 2026 Google LLC
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# Adapted from
+# https://github.com/cncf/prow-github-actions/blob/main/templates/workflow-templates/prow.yml
+
+# Note, prow-github-actions upstream suggests using pull_request_target so that
+# comments like /lgtm work on pull requests from forks (which is the primary
+# mode of contribution for Substrate).
+#
+# Zizmor flags pull_request_target as very dangerous [1], but it seems pretty
+# critical to how prow-github-actions works --- the workflow must have write
+# permissions to make comments.  The danger is that, if an attacker can cause
+# the workflow to execute their own code from a pull request they opened, then
+# they can use the repository write access.  The Zizmor docs that it's not
+# enough to not directly execute code from the attacker-controlled PR, since the
+# attacker could set environment values or indirectly attack
+# prow-github-actions. 
+#
+# Until we are confident that prow-github-actions is not vulnerable in this way,
+# we'll use a schedule trigger as the primary driver.  This won't be as snappy,
+# but seems more secure.
+#
+# [1] https://docs.zizmor.sh/audits/#dangerous-triggers
+
+# Prow for this repository: /commands on issues and pull requests, needs-* labels, reviewers
+# from OWNERS files, automatic merging on lgtm, and labels created from prow.yaml.
+# Docs: https://github.com/cncf/prow-github-actions/blob/main/docs/installing.md
+name: Prow
+on:
+  issues:
+    types: [opened, reopened, labeled, unlabeled]
+  issue_comment:
+    types: [created]
+  # pull_request_target is DISABLED --- see discussion at the top of the file.
+  pull_request_review:
+    types: [submitted, dismissed]
+  check_suite:
+    types: [completed]
+  # Replacement for pull_request_target --- drive the prow logic on a timer.
+  schedule:
+    - cron: '0/5 * * * *' # Run every 5 minutes
+  # label-sync: run once after installing, then whenever .github/prow.yaml changes
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths: [.github/prow.yaml]
+
+# One run per comment (commands are never collapsed); per event+action for everything else,
+# so a pending `synchronize` run can only be superseded by a newer `synchronize` run.
+# Never cancel a run that may be merging.
+concurrency:
+  group: prow-${{ github.event_name }}-${{ github.event.action }}-${{ github.event.comment.id || github.event.pull_request.number || github.event.issue.number || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  prow:
+    if: github.event_name != 'workflow_dispatch' && github.event_name != 'push'
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@5cbe53deaf5e765c4a816183fa6d6df401752461
+    with:
+      prow-commands: /lgtm /approve /hold /kind /area /priority
+      merge-method: squash
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+
+  label-sync:
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'push'
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@5cbe53deaf5e765c4a816183fa6d6df401752461
+    with:
+      jobs: label-sync
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write