[#1308][CI] label-pr workflow fails on fork-based PRs (#1309)

.github/workflows/pr-labeler.yml

@@ -16,22 +16,26 @@
 name: "Pull Request Labeler"
 run-name: Pull request labeler for ${{ github.ref_name }}
 
-on:
-  pull_request:
-    types: [opened]
+# NOTE: security risk from this action.
+# DO NOT add actions in here which need a checkout of the repo, and
+# DO NOT use any caching in here.
+on: pull_request_target
 
 jobs:
   label-pr:
     if: >-
       github.event.pull_request.user.login != 'octobot' &&
       github.event.pull_request.user.login != 'dependabot[bot]'
     permissions:
+      # for actions/labeler to determine modified files
       contents: read
+      # for actions/labeler to add labels to PRs
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/labeler@v4
       with:
         configuration-path: .github/pr-labeler-config.yml
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
+        # Remove labels when matching files are reverted
         sync-labels: true