Bump actions versions + correctly handle labels

.github/workflows/apply-benchmark-patch.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Check out PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}

.github/workflows/cargo-audit.yml

@@ -10,38 +10,87 @@ concurrency:
   group: cargo-audit-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   cargo-audit:
     name: cargo audit
     runs-on: [self-hosted, type-ccx13]
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-cargo-audit') }}
     steps:
+      - name: Decide whether to run, skip, or mirror previous result
+        id: gate
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const labels = context.payload.pull_request?.labels?.map(l => l.name) ?? [];
+            if (labels.includes('skip-cargo-audit')) {
+              core.info('skip-cargo-audit label present on PR; skipping audit work.');
+              core.setOutput('skip', 'true');
+              return;
+            }
+
+            const action = context.payload.action;
+            const labelName = context.payload.label?.name;
+            const isLabelEvent = action === 'labeled' || action === 'unlabeled';
+            if (isLabelEvent && labelName !== 'skip-cargo-audit') {
+              const sha = context.payload.pull_request.head.sha;
+              const runs = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'cargo-audit.yml',
+                head_sha: sha,
+                status: 'completed',
+                per_page: 20,
+              });
+              const prev = runs.data.workflow_runs.find(r => r.id !== context.runId);
+              core.info(`Previous completed run for ${sha}: ${prev?.conclusion ?? 'none'}`);
+              if (prev?.conclusion === 'success') {
+                core.setOutput('skip', 'true');
+                return;
+              }
+              if (prev?.conclusion === 'failure') {
+                core.setFailed('Mirroring previous failed run for this commit.');
+                return;
+              }
+            }
+
+            core.setOutput('skip', 'false');
+
       - name: Check-out repositoroy under $GITHUB_WORKSPACE
-        uses: actions/checkout@v4
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/checkout@v6
 
       - name: Install dependencies
+        if: steps.gate.outputs.skip != 'true'
         run: |
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
           sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" build-essential clang curl libssl-dev llvm libudev-dev protobuf-compiler pkg-config
 
       - name: Install Rust
+        if: steps.gate.outputs.skip != 'true'
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
 
       - name: Utilize Shared Rust Cache
+        if: steps.gate.outputs.skip != 'true'
         uses: Swatinem/rust-cache@v2
         with:
           key: cargo-audit
           cache-on-failure: true
 
       - name: Install cargo-audit
+        if: steps.gate.outputs.skip != 'true'
         run: cargo install --force cargo-audit
 
       - name: Display cargo-audit --version
+        if: steps.gate.outputs.skip != 'true'
         run: cargo audit --version
 
       - name: cargo audit
+        if: steps.gate.outputs.skip != 'true'
         run: |
           cargo audit --ignore RUSTSEC-2023-0091 \
                       --ignore RUSTSEC-2024-0438 \