From ac7b9ed88cf643283ee47b1f2a796bd80f5c3ff0 Mon Sep 17 00:00:00 2001
From: Mouna ALOUI <mouna.aloui@softathome.com>
Date: Wed, 5 Nov 2025 10:10:33 +0100
Subject: [PATCH] ci: blackduck: require label to run blackduck scan on merge
 requests

Replace manual trigger with label-based activation for BlackDuck scans
on MRs. Jobs now run automatically when the 'ci:allow-expensive-jobs'
label is added to the merge request,

References: PCF-1794
Signed-off-by: Mouna Aloui <mouna.aloui@softathome.com>
---
 .gitlab/blackduck.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.gitlab/blackduck.yml b/.gitlab/blackduck.yml
index a516204850..d4574e9c61 100644
--- a/.gitlab/blackduck.yml
+++ b/.gitlab/blackduck.yml
@@ -6,8 +6,7 @@
   rules:
     - if: $CI_COMMIT_REF_PROTECTED && $CI_COMMIT_TAG
     - if: $CI_PIPELINE_SOURCE == "schedule"
-    - if: "$CI_PIPELINE_SOURCE == 'merge_request_event'"
-      when: manual
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /ci::allow-expensive-jobs/'
   before_script:
     - touch .build_failed
     - export CI_BUILD_PROFILE="$(echo $CI_JOB_NAME | sed 's/blackduck scan \(.*\)/\1/')"