ci: Run cargo-semver-checks on PRs (#1598)

Run `cargo-ci-checks` on each PR, and add a comment with the output if
there are breaking changes.
See CQCL/hugrverse-actions#13

drive-by: Allow forcing the checks to run by adding a `run-ci-checks`
label to the PR. Imported from tket2.

https://github.com/CQCL/tket2/blob/740b3ec20f7d3889162c935a47cd0de9ba250a45/.github/workflows/ci.yml#L44

<img width="894" alt="image"
src="https://github.com/user-attachments/assets/10748599-e2ab-46fa-979f-d8246c203d5a">

.github/workflows/ci-rs.yml

@@ -25,20 +25,36 @@ jobs:
   # Check if changes were made to the relevant files.
   # Always returns true if running on the default branch, to ensure all changes are throughly checked.
   changes:
-    name: Check for changes in Rust files
+    name: Check for changes
     runs-on: ubuntu-latest
     # Required permissions
     permissions:
       pull-requests: read
     # Set job outputs to values from filter step
+    # These outputs are always true when running after a merge to main, or if the PR has a `run-ci-checks` label.
     outputs:
-      rust: ${{ github.ref_name == github.event.repository.default_branch || steps.filter.outputs.rust }}
+      rust: ${{ steps.filter.outputs.rust == 'true' || steps.override.outputs.out == 'true' }}
+      python: ${{ steps.filter.outputs.python == 'true' || steps.override.outputs.out == 'true' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          filters: .github/change-filters.yml
+    - uses: actions/checkout@v4
+    - name: Override label
+      id: override
+      run: |
+        echo "Label contains run-ci-checks: $OVERRIDE_LABEL"
+        if [ "$OVERRIDE_LABEL" == "true" ]; then
+          echo "Overriding due to label 'run-ci-checks'"
+          echo "out=true" >> $GITHUB_OUTPUT
+        elif [ "$DEFAULT_BRANCH" == "true" ]; then
+          echo "Overriding due to running on the default branch"
+          echo "out=true" >> $GITHUB_OUTPUT
+        fi
+      env:
+        OVERRIDE_LABEL: ${{ github.event_name == 'pull_request' && contains( github.event.pull_request.labels.*.name, 'run-ci-checks') }}
+        DEFAULT_BRANCH: ${{ github.ref_name == github.event.repository.default_branch }}
+    - uses: dorny/paths-filter@v3
+      id: filter
+      with:
+        filters: .github/change-filters.yml
 
   check:
     needs: changes
@@ -221,6 +237,15 @@ jobs:
           flags: rust
           token: ${{ secrets.CODECOV_TOKEN }}
 
+  rs-semver-checks:
+    needs: changes
+    if: ${{ needs.changes.outputs.rust == 'true' && github.event_name == 'pull_request' }}
+    uses: CQCL/hugrverse-actions/.github/workflows/rs-semver-checks.yml@main
+    with:
+      apt-dependencies: capnproto
+    secrets:
+      GITHUB_PAT: ${{ secrets.HUGRBOT_PAT }}
+
   # This is a meta job to mark successful completion of the required checks,
   # even if they are skipped due to no changes in the relevant files.
   required-checks: