feat: add ok-to-test workflow approval for external PRs

This workflow solves the current bottleneck where external contributors must
wait for maintainer approval to run any workflows, including functional tests.

- Problem:
Repository requires approval for all outside collaborators' fork PR workflows.
Therefore, external contributors can't run functional tests until maintainer approval.
Maintainers cannot approve without run functiona tests. This process forces manual local testing
and functional validation, slowing down reviews. So we can't enjoy much from function tests
and other tests in workflows.
In a short, it creates unnecessary friction between PR approval and workflow approval.

- Solution:
Add pr-approve-workflows.yaml to automatically approve pending workflow runs.
Uses pull_request_target with elevated permissions for security and triggers when 'ok-to-test'
label is added, separating PR review from workflow approval.

This enables external contributors to run functional tests immediately after
maintainer adds the ok-to-test label, significantly reducing review time and
eliminating the need for manual local testing.

This pattern is widely used in other opensource projects.

Signed-off-by: josedev-union <[email protected]>

Author: josedev-union

.github/workflows/pr-approve.yaml

@@ -0,0 +1,42 @@
+name: PR approve GH Workflows
+
+on:
+  pull_request_target:
+    types:
+      - edited
+      - labeled
+      - reopened
+      - synchronize
+
+permissions: {}
+
+jobs:
+  approve:
+    name: Approve ok-to-test
+    if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: Update PR
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        continue-on-error: true
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const result = await github.rest.actions.listWorkflowRunsForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event: "pull_request",
+              status: "action_required",
+              head_sha: context.payload.pull_request.head.sha,
+              per_page: 100
+            });
+
+            for (var run of result.data.workflow_runs) {
+              await github.rest.actions.approveWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: run.id
+              });
+            }