Add digger:force label to bypass impacted projects limit (#2549)

* Auto-succeed digger/apply check when plan shows zero changes

This change implements automatic success for the digger/apply check when
all plan jobs complete with zero infrastructure changes, eliminating the
need for manual intervention in no-change scenarios.

Changes:
- Create both digger/plan and digger/apply checks when PR opens with plan jobs
- The apply check starts in "queued" state with message indicating it will
  auto-succeed if no changes are detected
- After plan batch completes successfully, detect if all jobs have zero changes
  (ResourcesCreated = 0, ResourcesUpdated = 0, ResourcesDeleted = 0)
- If all jobs have zero changes, automatically update apply check to "completed"
  with "success" conclusion
- Add GetCheckRunsForCommit() method to query check runs for a commit SHA

Benefits:
- Improved UX: Users see both checks immediately when PR opens
- Automation: No manual action needed for zero-change plans
- Clear communication: Check messages explain the automatic behavior
- No breaking changes: Existing behavior for plans with changes unchanged

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* feat: add digger:force label to bypass impacted projects limit

Add support for the 'digger:force' label on pull requests to bypass
the ImpactedProjectsPerChange limit. This allows users to intentionally
proceed with plan/apply operations on PRs that impact more projects than
the configured limit.

Changes:
- Check for 'digger:force' label in both PR and comment event handlers
- Update error messages to inform users about the bypass option
- Add warning logs when limit is bypassed for audit purposes
- Add slices import to github_comment.go for label checking

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: substrate-bot <bot@substrate.run>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: 3 people

backend/controllers/github_comment.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"os"
 	"runtime/debug"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -359,14 +360,15 @@ func handleIssueCommentEvent(gh utils.GithubClientProvider, payload *github.Issu
 	}
 
 	maxImpactedProjectsPerChange := config2.MaxImpactedProjectsPerChange()
-	if len(impactedProjectsForComment) > maxImpactedProjectsPerChange {
+	hasForceLabel := slices.Contains(prLabelsStr, "digger:force")
+	if len(impactedProjectsForComment) > maxImpactedProjectsPerChange && !hasForceLabel {
 		slog.Error("Number of impacted projects exceeds number of changed files",
 			"prNumber", issueNumber,
 			"impactedProjectCount", len(impactedProjectsForComment),
 			"changedFileCount", len(changedFiles),
 		)
 
-		commentReporterManager.UpdateComment(fmt.Sprintf(":x: Error the number impacted projects %v exceeds Max allowed ImpactedProjectsPerChange: %v, we set this limit to protect against hitting github API limits", len(impactedProjectsForComment), maxImpactedProjectsPerChange))
+		commentReporterManager.UpdateComment(fmt.Sprintf(":x: Error the number impacted projects %v exceeds Max allowed ImpactedProjectsPerChange: %v, we set this limit to protect against hitting github API limits. Add the 'digger:force' label to bypass this limit.", len(impactedProjectsForComment), maxImpactedProjectsPerChange))
 
 		slog.Debug("Detailed event information",
 			slog.Group("details",
@@ -378,6 +380,14 @@ func handleIssueCommentEvent(gh utils.GithubClientProvider, payload *github.Issu
 		return fmt.Errorf("error processing event")
 	}
 
+	if hasForceLabel && len(impactedProjectsForComment) > maxImpactedProjectsPerChange {
+		slog.Warn("Bypassing impacted projects limit due to digger:force label",
+			"prNumber", issueNumber,
+			"impactedProjectCount", len(impactedProjectsForComment),
+			"maxAllowed", maxImpactedProjectsPerChange,
+		)
+	}
+
 	if !config.AllowDraftPRs && isDraft {
 		slog.Info("Draft PRs are disabled, skipping",
 			"issueNumber", issueNumber,

backend/controllers/github_pull_request.go

@@ -261,14 +261,15 @@ func handlePullRequestEvent(gh utils.GithubClientProvider, payload *github.PullR
 	}
 
 	maxImpactedProjectsPerChange := config2.MaxImpactedProjectsPerChange()
-	if len(impactedProjects) > maxImpactedProjectsPerChange {
+	hasForceLabel := slices.Contains(prLabelsStr, "digger:force")
+	if len(impactedProjects) > maxImpactedProjectsPerChange && !hasForceLabel {
 		slog.Error("Number of impacted projects exceeds number of changed files",
 			"prNumber", prNumber,
 			"impactedProjectCount", len(impactedProjects),
 			"changedFileCount", len(changedFiles),
 		)
 
-		commentReporterManager.UpdateComment(fmt.Sprintf(":x: Error the number impacted projects %v exceeds Max allowed ImpactedProjectsPerChange: %v, we set this limit to protect against hitting github API limits", len(impactedProjects), maxImpactedProjectsPerChange))
+		commentReporterManager.UpdateComment(fmt.Sprintf(":x: Error the number impacted projects %v exceeds Max allowed ImpactedProjectsPerChange: %v, we set this limit to protect against hitting github API limits. Add the 'digger:force' label to bypass this limit.", len(impactedProjects), maxImpactedProjectsPerChange))
 
 		slog.Debug("Detailed event information",
 			slog.Group("details",
@@ -280,6 +281,14 @@ func handlePullRequestEvent(gh utils.GithubClientProvider, payload *github.PullR
 		return fmt.Errorf("error processing event")
 	}
 
+	if hasForceLabel && len(impactedProjects) > maxImpactedProjectsPerChange {
+		slog.Warn("Bypassing impacted projects limit due to digger:force label",
+			"prNumber", prNumber,
+			"impactedProjectCount", len(impactedProjects),
+			"maxAllowed", maxImpactedProjectsPerChange,
+		)
+	}
+
 	diggerCommand, err := scheduler.GetCommandFromJob(jobsForImpactedProjects[0])
 	if err != nil {
 		slog.Error("Could not determine Digger command from job",