Migrate Labeler workflow away from pull_request_target #2773

Is your feature request related to a problem or challenge? Please describe what you are trying to do.

GitHub will block the pull_request_target trigger by default on public repositories from December 2, 2026, with brownouts before that (changelog). ASF infra is also disabling the trigger for ASF repositories (policy). Upstream tracking issue: apache/datafusion#26406.

.github/workflows/dev_pr.yml (the "Labeler" workflow) runs actions/labeler on pull_request_target. Once the trigger is blocked, pull requests, including ones from forks, stop getting path labels automatically.

Describe the solution you'd like

Move to the two-workflow pattern that apache/datafusion#26683 uses:

1. A pull_request workflow with no write access records the PR number (and the changed paths, if needed) and uploads it as an artifact.
2. A workflow_run workflow, triggered when the first one completes, runs in the base repository context with pull-requests: write, reads the artifact, and applies the labels from .github/workflows/dev_pr/labeler.yml. It treats the artifact as untrusted data and never checks out or runs PR code.

Describe alternatives you've considered

• A GitHub App such as Boring Cyborg, which ASF infra suggests for labeling.
• Dropping automatic labeling and labeling by hand.

Additional context

• ASF guidance: https://cwiki.apache.org/confluence/spaces/BUILDS/pages/321719166/GitHub+Actions+Security
• DataFusion migration PR: ci: migrate pull_request_target workflows to workflow_run datafusion#26683