Project automation bug fixes (#15971)

## Description
This PR resolves two bugs in the recent pr #15945

## external issue labeling
Recent runs show that it is labeling [issues
created](#15967) by team members
as `External`

Using graphQL to explore the authorAssociation shows
`"authorAssociation": "MEMBER"` - I've updated the permissions to be
specific to the job in an attempt to ensure that we have the permissions
we need. Testing this action in personal repos shows it works as
expected so not 100% on what's going on.

A PR was also unable to run due to the token only having read
permissions, so hopefully this is a two birds one stone fix.

It may be beneficial to re-run
https://github.com/rapidsai/cudf/actions/runs/9462546964/job/26065765728
with debug mode on to see if `author_association` is different to the
action (which would be concerning)

*edit test*

## project automation
This fixes the workflow incorrectly calling my personal workflows for
testing.


## Checklist
- [x] I am familiar with the [Contributing
Guidelines](https://github.com/rapidsai/cudf/blob/HEAD/CONTRIBUTING.md).
- [ ] ~New or existing tests cover these changes.~
- [ ] ~The documentation is up to date with these changes.~

.github/workflows/external_issue_labeler.yml

@@ -20,36 +20,41 @@ on:
     types:
       - opened
 
-  pull_request:
+  pull_request_target:
     types:
       - opened
 
 env:
   GITHUB_TOKEN: ${{ github.token }}
 
-permissions:
-  issues: write
-  pull-requests: write
-
 jobs:
   Label-Issue:
     runs-on: ubuntu-latest
-    # Only run if the issue author is not part of RAPIDS
-    if: ${{ ! contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association)}}
+    permissions:
+      issues: write
+    if: github.event_name == 'issues'
     steps:
       - name: add-external-labels
+        # Only run if the issue author is not part of RAPIDS
+        if: ${{ ! contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association)}}
         run: |
+          echo ${{ github.event.issue.author_association }}
           issue_url=${{ github.event.issue.html_url }}
           gh issue edit ${issue_url} --add-label "External"
         continue-on-error: true
 
   Label-PR:
     runs-on: ubuntu-latest
-    # Only run if the issue author is not part of RAPIDS
-    if: ${{ ! contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)}}
+    permissions:
+      pull-requests: write
+      issues: write
+    if: github.event_name == 'pull_request_target'
     steps:
       - name: add-external-labels
+        # Only run if the issue author is not part of RAPIDS
+        if: ${{ ! contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)}}
         run: |
+            echo ${{ github.event.pull_request.author_association }}
             pr_url=${{ github.event.pull_request.html_url }}
             gh issue edit ${pr_url} --add-label "External"
-    continue-on-error: true
+        continue-on-error: true

.github/workflows/pr_issue_status_automation.yml

@@ -50,7 +50,7 @@ jobs:
 
     update-sprint:
       # This job sets the PR and its linked issues to the current "Weekly Sprint"
-      uses: jarmak-nv/shared-workflows/.github/workflows/[email protected]
+      uses: rapidsai/shared-workflows/.github/workflows/[email protected]
       if: github.event.pull_request.state == 'open'
       needs: get-project-id
       with: