ci(e2e): make the upgrade-e2e label opt-in actually start a run

main gained a `labeled` pull_request trigger whose plan/resolve guards
discard every label event except `full-e2e`. This lane's documented opt-in
("any PR a maintainer opts in with the upgrade-e2e label") therefore did
nothing after the rebase: adding the label fired a `labeled` event, `plan`
skipped, `finalize` skipped with it, and upgrade-e2e never satisfied its
needs. Before the rebase there was no `labeled` trigger at all, so the label
was only ever read on push — the gap appeared with the new base, not here.

Admit `upgrade-e2e` alongside `full-e2e` in both allowlists so labelling an
open PR starts a run, and use !cancelled() rather than always() in the job
gate, matching the sibling `e2e` job: a cancelled run must not go on to
occupy a 32-vCPU runner for up to 180 minutes.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

.github/workflows/pull-requests.yaml

@@ -6,8 +6,9 @@ env:
 on:
   pull_request:
     # `labeled` makes the promote PR's release-candidate verification and manual
-    # full-e2e opt-in actionable after the bot opens it. The plan/resolve guards
-    # below discard every other label event before it can launch work.
+    # full-e2e opt-in — and the upgrade-e2e opt-in on any PR — actionable after
+    # the PR is open. The plan/resolve guards below discard every other label
+    # event before it can launch work.
     types: [opened, synchronize, reopened, labeled]
 
 # Cancel in‑flight runs for the same PR when a new push arrives.
@@ -67,7 +68,7 @@ jobs:
     runs-on: ubuntu-latest
     # Exact complement of the concurrency key above; see the reasoning there,
     # including why `release` is admitted for same-repo PRs only.
-    if: github.event.action != 'labeled' || github.event.label.name == 'full-e2e' || (github.event.label.name == 'release' && !github.event.pull_request.head.repo.fork)
+    if: github.event.action != 'labeled' || contains(fromJSON('["full-e2e","upgrade-e2e"]'), github.event.label.name) || (github.event.label.name == 'release' && !github.event.pull_request.head.repo.fork)
     permissions:
       contents: read
       # For the opening `E2E Tests` status below; e2e-report writes the terminal
@@ -744,7 +745,7 @@ jobs:
     # pre-existing behaviour on a push to such a PR is unchanged.
     if: |
       contains(github.event.pull_request.labels.*.name, 'release')
-      && (github.event.action != 'labeled' || github.event.label.name == 'full-e2e' || (github.event.label.name == 'release' && !github.event.pull_request.head.repo.fork))
+      && (github.event.action != 'labeled' || contains(fromJSON('["full-e2e","upgrade-e2e"]'), github.event.label.name) || (github.event.label.name == 'release' && !github.event.pull_request.head.repo.fork))
     outputs:
       disk_id:      ${{ steps.fetch_assets.outputs.disk_id }}
 
@@ -1199,8 +1200,11 @@ jobs:
       contents: read
       packages: read
     needs: ["finalize", "build-talos", "resolve_assets"]
+    # !cancelled() rather than always(), matching the sibling `e2e` job: a
+    # cancelled run must not go on to occupy a 32-vCPU runner for up to 180
+    # minutes.
     if: >-
-      always()
+      !cancelled()
       && (needs.finalize.result == 'success' || needs.resolve_assets.result == 'success')
       && (contains(github.event.pull_request.labels.*.name, 'release')
           || contains(github.event.pull_request.labels.*.name, 'upgrade-e2e'))