ci: replace labeler pull_request_target with safe pull_request + workflow_run split

The labeler workflow used pull_request_target, which runs in the base-repo
context with a write token and (for fork PRs) secret access. Per SOP this
trigger is disallowed even though the workflow did not check out or run PR code.

Split into two workflows following GitHub's recommended safe pattern:
- labeler.yml (pull_request): untrusted context, read-only token, no secrets.
  Records only the PR number as an artifact.
- labeler-apply.yml (workflow_run): trusted base-repo context with the write
  token. Downloads the PR number and applies labels via actions/labeler using
  its pr-number input. labeler reads the trusted base .github/labeler.yml and
  the PR's changed-file list via the API, so no PR-authored code executes.

This preserves labeling on fork PRs (which a plain pull_request trigger cannot
do). Helper actions pinned to commit SHAs.

Signed-off-by: ravjotb <ravjot.brar@improving.com>

Author: ravjotbrar

.github/workflows/labeler-apply.yml

@@ -0,0 +1,49 @@
+name: Label PRs (apply)
+
+# Trusted half of the safe labeling split (see labeler.yml).
+# Runs in the base-repo context with a write token AFTER the untrusted
+# "Label PRs" workflow completes. It downloads the PR number that workflow
+# recorded and applies labels via actions/labeler. No PR-authored code is
+# checked out or executed here: labeler reads the trusted base-repo
+# .github/labeler.yml and the PR's changed-file list via the GitHub API.
+
+on:
+  workflow_run:
+    workflows: ["Label PRs"]
+    types: [completed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  apply-labels:
+    runs-on: ubuntu-latest
+    # Only act on successful runs that actually produced the artifact.
+    if: >
+      github.event.workflow_run.event == 'pull_request'
+      && github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Download PR number artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: pr-number
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read PR number
+        id: pr
+        run: |
+          number="$(cat pr-number.txt)"
+          # Guard: must be a positive integer before we trust it downstream.
+          if ! [[ "$number" =~ ^[0-9]+$ ]]; then
+            echo "Invalid PR number: '$number'" >&2
+            exit 1
+          fi
+          echo "number=$number" >> "$GITHUB_OUTPUT"
+
+      - name: Apply labels
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-number: ${{ steps.pr.outputs.number }}

.github/workflows/labeler.yml

@@ -1,17 +1,29 @@
 name: Label PRs
 
+# Safe two-workflow labeling (avoids pull_request_target):
+#   1. This workflow runs in the UNTRUSTED pull_request context with a read-only
+#      token and no secrets. It does not check out or run PR code — it only
+#      records the PR number as an artifact.
+#   2. `labeler-apply.yml` runs on workflow_run (trusted base-repo context) with
+#      the write token and applies the labels. This preserves labeling on fork
+#      PRs, which a plain pull_request trigger cannot do on its own.
+
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize]
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
-  label:
+  record-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v7
+      - name: Save PR number
+        run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
+      - name: Upload PR number artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          name: pr-number
+          path: pr-number.txt
+          retention-days: 1