From d2ad845a72585b57ee8d28372c1b8d5e646df1af Mon Sep 17 00:00:00 2001
From: jkbennitt <65491917+jkbennitt@users.noreply.github.com>
Date: Wed, 4 Nov 2026 14:25:35 -0500
Subject: [PATCH] ci: add hold-label gate workflow

---
 .github/workflows/hold.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .github/workflows/hold.yml

diff --git a/.github/workflows/hold.yml b/.github/workflows/hold.yml
new file mode 100644
index 0000000..e0b45b2
--- /dev/null
+++ b/.github/workflows/hold.yml
@@ -0,0 +1,22 @@
+name: hold
+on:
+  pull_request:
+    branches: [main, master]
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+permissions: {}
+concurrency:
+  group: hold-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+jobs:
+  hold-gate:
+    name: Hold label
+    runs-on: [self-hosted, appsprout-linux]
+    env:
+      HAS_HOLD: ${{ contains(toJSON(github.event.pull_request.labels.*.name), '"hold"') }}
+    steps:
+      - name: Fail when the hold label is present
+        run: |
+          if [ "$HAS_HOLD" = "true" ]; then
+            echo "::error title=On hold::This PR has the hold label. Only Jason lifts a hold; it will not merge until he removes it."
+            exit 1
+          fi