name: Label AI changes

# pull_request_target runs in the context of the base branch, so it can add labels
# to PRs from forks. This workflow never checks out or runs PR code, which keeps
# that safe. Do not add a checkout step here.
on:
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  label:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/labeler@v5
        with:
          configuration-path: .github/labeler.yml
          # Remove labels again when a later push no longer touches matching files.
          sync-labels: true