migrate labeler to use dd-octo-sts (DataDog#23179)

Author: steveny91

.github/workflows/labeler-community.yml

@@ -15,9 +15,7 @@ jobs:
   labeler:
     if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} # only PRs from other repos
     permissions:
-      pull-requests: write # Needed for labeler-reusable.yml
       contents: read # Needed for labeler-reusable.yml
+      id-token: write # Needed for dd-octo-sts OIDC token exchange
+      pull-requests: write # Needed for labeler-reusable.yml
     uses: ./.github/workflows/labeler-reusable.yml
-    secrets:
-      app-id: "${{ secrets.DD_AGENT_INTEGRATIONS_BOT_APP_ID }}"
-      private-key: "${{ secrets.DD_AGENT_INTEGRATIONS_BOT_PRIVATE_KEY }}"

.github/workflows/labeler-reusable.yml

@@ -4,11 +4,6 @@ name: Reusable Labeler Workflow
 
 on:
   workflow_call:
-    secrets:
-      app-id:
-        required: true
-      private-key:
-        required: true
 
 jobs:
   apply:
@@ -17,15 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write # Required for dd-octo-sts OIDC token exchange
       pull-requests: write
     steps:
-      - name: Create token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+      - name: Get token via dd-octo-sts
+        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: token-generator
         with:
-          app-id: ${{ secrets.app-id }}
-          private-key: ${{ secrets.private-key }}
-          repositories: integrations-core
+          scope: DataDog/integrations-core
+          policy: self.labeler.pull-request
       - name: Add labels
         uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:

.github/workflows/labeler.yml

@@ -13,9 +13,7 @@ jobs:
   labeler:
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} # only PRs from this repo
     permissions:
-      pull-requests: write # Needed for labeler-reusable.yml
       contents: read # Needed for labeler-reusable.yml
+      id-token: write # Needed for dd-octo-sts OIDC token exchange
+      pull-requests: write # Needed for labeler-reusable.yml
     uses: ./.github/workflows/labeler-reusable.yml
-    secrets:
-      app-id: "${{ secrets.DD_AGENT_INTEGRATIONS_BOT_APP_ID }}"
-      private-key: "${{ secrets.DD_AGENT_INTEGRATIONS_BOT_PRIVATE_KEY }}"