Migrate dialect labeler away from pull_request_target #2818

Is your feature request related to a problem or challenge?

GitHub will block the pull_request_target trigger by default on public repositories from December 2, 2026, with brownouts before that (changelog). ASF infra is also disabling the trigger for ASF repositories (policy). Upstream tracking issue: apache/datafusion#26406.

.github/workflows/labeler.yml (the dialect labeler) runs on pull_request_target, issues, and issue_comment. Once pull_request_target is blocked, pull requests stop getting dialect labels automatically. Issues will still get them, and so will comments on issues and pull requests, because those triggers aren't affected.

Describe the solution you'd like

Move the pull request path to the two-workflow pattern that apache/datafusion#26683 uses:

1. A pull_request workflow with no write access records the PR number and uploads it as an artifact.
2. A workflow_run workflow, triggered when the first one completes, runs in the base repository context with pull-requests: write, reads the artifact, and runs .github/workflows/labeler/label_dialects.js from the base branch against that PR. It treats the artifact as untrusted data and never checks out or runs PR code.

The issues and issue_comment triggers can stay as they are.

Describe alternatives you've considered

• A GitHub App such as Boring Cyborg, which ASF infra suggests for labeling. It may not cover the dialect detection that label_dialects.js does.
• Labeling pull requests by hand, keeping automatic labeling for issues only.

Additional context

• ASF guidance: https://cwiki.apache.org/confluence/spaces/BUILDS/pages/321719166/GitHub+Actions+Security
• DataFusion migration PR: ci: migrate pull_request_target workflows to workflow_run datafusion#26683