name: labeler

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

on:
  pull_request_target: # zizmor: ignore[dangerous-triggers] does not checkout, safe to use pull_request_target

jobs:
  labeler:
    runs-on: ubuntu-latest
    permissions:
      contents: read # same as global permission
      pull-requests: write # required for writing labels
    steps:
      -
        name: Run
        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
        with:
          sync-labels: true