Add a CI check for do-not-merge label

.github/workflows/do-not-merge-checker.yml

@@ -0,0 +1,22 @@
+# This workflow fails if a 'do-not-merge' label is applied to the PR.
+name: Check do-not-merge
+
+on:
+  pull_request:
+    types: [reopened, labeled, unlabeled]
+    # Runs on PRs to main and release branches
+    branches:
+      - main
+      - release/**
+
+jobs:
+  # checks that a do-not-merge label is not present for a PR
+  do-not-merge-check:
+    # If there is a `do-not-merge` label, or this comes from a fork (community contributor) we ignore this check
+    if: ${{ (github.repository_owner == 'hashicorp' && contains(github.event.pull_request.labels.*.name, 'do-not-merge')) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if do-not-merge label is applied
+        run: |
+          echo "Cannot merge with do-not-merge label applied."
+          exit 1