ci: backport, pr-size and pr-labeler stop on 2026-12-02, GitHub blocks pull_request_target by default #5135

GitHub starts enforcing default Actions policy on public repositories on 2026-12-02. It blocks workflow runs triggered by pull_request_target, unless some Actions policy allowing the event applies to the repo. Now it works in evaluate mode, so runs go through and only violations are recorded. Docs: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target

We have three workflows with this trigger:

• .github/workflows/backport.yaml:4 (closed, labeled)
• .github/workflows/pr-size.yaml:4 (opened, synchronize, reopened)
• .github/workflows/pr-labeler.yaml:4 (opened, reopened, synchronize)

After enforcement none of them starts, so merged PRs are not backported to release lines and new PRs get no size/*, kind/* and area/* labels. Evaluate mode already recorded it, org audit log has workflows.actions_policy_violation with is_evaluate_mode: true and allowed: true for this Automatic Backport run (same timestamp, 2026-10-27 07:15:02 UTC).

No job checks out PR head. pr-size and pr-labeler only read the PR through API (title, body, file list) and add labels, backport.yaml checks out base branch (no ref: set) and runs korthout/backport-action with GITHUB_TOKEN. On fork PRs pull_request gives read-only token, so these can't just move to it, and I think allowing the event with an Actions policy is the way.

Not sure at which level the policy is set (repo, org or enterprise). Audit log shows the org under cncf business, so it may need their admins.

Done when the policy is in place and policy insights show nothing would be blocked for these three workflows.