Migrate labeler workflow away from pull_request_target #273

Is your feature request related to a problem or challenge?

GitHub will block the pull_request_target trigger by default on public repositories from December 2, 2026, with brownouts before that (changelog). ASF infra is also disabling the trigger for ASF repositories (policy). Upstream tracking issue: apache/datafusion#26406.

.github/workflows/labeler.yml runs actions/labeler on pull_request_target. Once the trigger is blocked, pull requests, including ones from forks, stop getting path labels automatically.

Describe the solution you'd like

Mirror whatever apache/datafusion adopts, since this repository's labeler matches DataFusion's. apache/datafusion#26683 moves to the two-workflow pattern:

1. A pull_request workflow with no write access records the PR number and uploads it as an artifact.
2. A workflow_run workflow, triggered when the first one completes, runs in the base repository context with pull-requests: write, reads the artifact, and applies the labels from .github/workflows/labeler/labeler-config.yml. It treats the artifact as untrusted data and never checks out or runs PR code.

Describe alternatives you've considered

• A GitHub App such as Boring Cyborg, which ASF infra suggests for labeling.
• Removing the labeler from the sandbox.

Additional context

• ASF guidance: https://cwiki.apache.org/confluence/spaces/BUILDS/pages/321719166/GitHub+Actions+Security
• DataFusion migration PR: ci: migrate pull_request_target workflows to workflow_run datafusion#26683