[ci] add GitHub-based private CI

Signed-off-by: Gary Guo <[email protected]>

.github/workflows/private-ci.yml

@@ -0,0 +1,46 @@
+# Copyright lowRISC contributors.
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Private CI
+
+on:
+  push:
+    branches-ignore:
+      - "backport-*"
+    tags:
+      - "*"
+  pull_request_target:
+    branches:
+      - "*"
+
+permissions:
+  contents: write # For repository dispatch
+
+jobs:
+  trigger:
+    name: Trigger Private CI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Private CI
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const payload = {
+              sha: context.eventName === 'pull_request_target' ? context.payload.pull_request.head.sha : context.sha,
+              pull_request: context.issue.number,
+              inputs: {
+                // For push events, also send branch name (for batching)
+                branch: context.eventName === 'pull_request_target' ? undefined : context.ref,
+                run_name: context.eventName === 'pull_request_target' ? context.payload.pull_request.title : context.payload.head_commit.message.split('\n')[0],
+              },
+            };
+            await github.rest.repos.createDispatchEvent({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event_type: 'cross-repo-ci',
+              client_payload: {
+                ...payload,
+                target: `${context.repo.owner}/opentitan-private-ci/master/private-ci-integrated.yml`,
+              }
+            });

.github/workflows/rerun.yml

@@ -0,0 +1,62 @@
+# Copyright lowRISC contributors.
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Rerun Failed Workflow
+on:
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  actions: write
+  contents: write # For repository dispatch
+  pull-requests: write # For label removal
+
+jobs:
+  rerun:
+    name: Rerun Failed CI
+    if: github.event.label.name == 'CI:Rerun'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Rerun failed GitHub actions
+        uses: actions/github-script@v7
+        with:
+          script: |
+            for await (const response of github.paginate.iterator(
+              github.rest.actions.listWorkflowRunsForRepo,
+              {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                // Only return completed workflows, not queued and in_progress.
+                status: 'completed',
+                head_sha: context.payload.pull_request.head.sha,
+              }
+            )) {
+              for (let run of response.data) {
+                if (run.conclusion !== 'failure') continue;
+
+                await github.rest.actions.reRunWorkflowFailedJobs({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: run.id,
+                });
+              }
+            }
+
+            // Trigger a cross-repo-ci-rerun event for private CI
+            github.rest.repos.createDispatchEvent({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event_type: 'cross-repo-ci-rerun',
+              client_payload: {
+                sha: context.payload.pull_request.head.sha,
+              }
+            });
+
+            // Remove label once failed job retriggered.
+            await github.rest.issues.removeLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              name: 'CI:Rerun',
+            });