add labeler workflow

Author: Kalle Fagerberg

.github/labeler.yml

@@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: 2026 Kalle Fagerberg
+#
+# SPDX-License-Identifier: CC0-1.0
+
+go:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/*.go"
+          - "**/go.mod"
+          - "**/go.sum"
+          - "**/go.work"
+
+dependencies:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/go.mod"
+          - "**/go.sum"
+          - "**/mise.toml"
+          - "**/mise.lock"
+
+github_actions:
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".github/workflows/*"
+          - ".github/dependabot.yml"
+          - ".github/labeler.yml"
+
+documentation:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/*.md"
+          - "docs/*"
+
+assets:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "assets/**"

.github/workflows/labeler.yml

@@ -0,0 +1,17 @@
+name: "Pull Request Labeler"
+on:
+  # Using "pull_request_target" is generally a security hole, but only
+  # if you also use "actions/checkout" in your job.
+  # Since we're not using "actions/checkout", then using "pull_request_target"
+  # is completely safe.
+  # zizmor: ignore[dangerous-triggers]
+  - pull_request_target
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1