Enforce labels workflow (#260)

.github/workflows/enforce-labels.yml

@@ -0,0 +1,19 @@
+---
+name: Enforce PR labels
+
+on:
+  workflow_call:
+  pull_request:
+    types: [labeled, unlabeled, opened, reopened, synchronize]
+jobs:
+  enforce-label:
+    if: ${{ contains(github.event.*.labels.*.name, 'hold') || contains(github.event.*.labels.*.name, 'needs-qa') }}
+    name: Enforce label
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Check for label
+        run: |
+          echo "PRs with the hold or needs-qa labels cannot be merged"
+          echo "### :x: PRs with the hold or needs-qa labels cannot be merged" >> $GITHUB_STEP_SUMMARY
+          exit 1