ci: Allow PRs to trigger Patina Nightly Pipeline via label

Guide/src/dev_guide/contrib/code.md

@@ -490,3 +490,18 @@ control over when to use this more resource-intensive testing.
 
 Only repository maintainers can add labels to PRs. If you need release gates
 run on your PR, ask a maintainer to add the `release-ci-required` label for you.
+
+## Patina Workflow
+
+To run release-mode check-in gates with Patina ClangPDB UEFI firmware:
+
+1. Ensure your PR targets `main` or `release/*` and is not a draft.
+2. Ask a repository maintainer to add the `needs-patina` label.
+3. The **OpenVMM Patina Nightly** workflow starts automatically for your PR.
+
+New commits rerun the workflow while the label remains present. To trigger
+another run without pushing a commit, remove and re-add the label. Draft PRs
+run when marked ready for review if the label is already present.
+
+The same workflow also runs on its nightly schedule and supports manual runs
+through GitHub Actions, without requiring a PR label.

flowey/flowey_hvlite/src/pipelines/checkin_gates.rs

@@ -140,8 +140,12 @@ impl IntoPipeline for CheckinGatesCli {
                         .gh_set_name("[Optional] OpenVMM Release PR");
                 }
                 PipelineConfig::PatinaNightly => {
+                    let mut triggers = GhPrTriggers::new_draftable();
+                    triggers.branches = branches;
+                    triggers.types.push("labeled".into());
                     pipeline
                         .gh_set_name("OpenVMM Patina Nightly")
+                        .gh_set_pr_triggers(triggers)
                         .gh_add_schedule_trigger(GhScheduleTriggers {
                             cron: "0 19 * * *".into(),
                             timezone: Some("America/Los_Angeles".into()),
@@ -205,6 +209,16 @@ impl IntoPipeline for CheckinGatesCli {
                     "contains(github.event.pull_request.labels.*.name, 'release-ci-required') && github.event.pull_request.draft == false",
                 );
             }
+            // Keep patina nightly scheduled/manual runs unconditional; PR runs require the label and a non-draft PR.
+            if patina_nightly {
+                let non_pr_run = "github.event_name != 'pull_request'";
+                let has_patina_label =
+                    "contains(github.event.pull_request.labels.*.name, 'needs-patina')";
+                let ready_for_review = "github.event.pull_request.draft == false";
+                job = job.gh_dangerous_override_if(format!(
+                    "{non_pr_run} || ({has_patina_label} && {ready_for_review})",
+                ));
+            }
 
             job
         });