[Acruve15]

The triage job (actions/labeler) fails on every fork PR with HttpError: Resource not accessible by integration: on the pull_request event GitHub caps GITHUB_TOKEN at read-only for forks, whatever the job declares. Seen on #724 (run 39983016236).

This moves the job to its own triage.yml workflow on pull_request_target, which runs in the base repo context with a writable token. It stays safe because the job never checks out PR code: the labeler reads the changed files and .github/labeler.yml through the API. Permissions are unchanged (contents: read, pull-requests: write).

Note: pull_request_target runs the workflow file from main, so the new job only starts running once this is merged.

Checked with actionlint and zizmor (only remaining finding is the tag pin, same convention as the other workflows).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.87%. Comparing base (68bde16) to head (5de102a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #726   +/-   ##
=======================================
  Coverage   94.87%   94.87%           
=======================================
  Files          60       60           
  Lines        3278     3278           
=======================================
  Hits         3110     3110           
  Misses        168      168           

Flag	Coverage Δ
backend	95.03% <ø> (ø)
client	91.30% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.