ci(dependabot-changeset): use a deploy key instead of `GITHUB_TOKEN` [AR-59671] #1765

	name: PR Labeler

	# WARNING:
	# Using `pull_request_target` here because we want to be able to add labels to PRs from forks.
	# `pull_request_target` can be UNSAFE because it runs in the TARGET repo context (not fork context).
	#
	# DO NOT CHECK OUT THE REPO IN THIS WORKFLOW
	#
	# See: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
	on: pull_request_target # zizmor: ignore[dangerous-triggers] See above warning.

	permissions: {}

	# This allows a subsequently queued workflow run to interrupt previous runs
	concurrency:
	group: '${{ github.workflow }} @ ${{ github.event.pull_request.number }}'
	cancel-in-progress: true

	jobs:
	sync-labels:
	name: Sync Labels
	runs-on: ubuntu-latest

	permissions:
	contents: read
	pull-requests: write

	# Skip release PRs
	if: \|
	! (github.event.pull_request.title == 'chore(release): publish' && github.event.pull_request.user.login == 'github-actions[bot]')

	steps:
	- name: Checkout source code
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false

	- name: Label PR
	uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
	with:
	configuration-path: .github/labeler-config.yml
	sync-labels: true

Provide feedback