test two ci action groups

.github/workflows/ci.yml

@@ -1,11 +1,34 @@
 # this workflow will run on every pr to make sure the project is following the guidelines
 
-name: CI
+# run labeler with elevated permissions before other actions
+name: CI-labeler
 
 on:
- pull_request:
+ pull_request_target:
  branches: ["*"]
 
+ labeler:
+ name: Label PR
+ permissions:
+ contents: read
+ pull-requests: write
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/labeler@v4
+ with:
+ repo-token: "${{ secrets.GITHUB_TOKEN }}"
+ sync-labels: true
+
+# after labeler, run other actions with strict permissions
+name: CI-main
+
+on:
+ workflow_run:
+ workflows: ["CI-labeler"]
+ branches: ["*"]
+ types: 
+ - completed
+
 env:
  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
@@ -19,17 +42,7 @@ jobs:
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
- labeler:
- name: Label PR
- permissions:
- contents: read
- pull-requests: write
- runs-on: ubuntu-latest
- steps:
- - uses: actions/labeler@v4
- with:
- repo-token: "${{ secrets.GITHUB_TOKEN }}"
- sync-labels: true
+
 
  lint:
  runs-on: ubuntu-latest