fix: two ci action groups (test)

.github/workflows/ci-labeler.yml

@@ -0,0 +1,22 @@
+# this workflow will run on every pr to make sure the project is following the guidelines
+
+# run labeler with elevated permissions before other actions
+
+name: Labeler
+
+on:
+  pull_request_target:
+    branches: ["*"]
+
+jobs:
+  labeler:
+    name: Label PR
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v4
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          sync-labels: true

.github/workflows/ci.yml

@@ -1,9 +1,12 @@
 # this workflow will run on every pr to make sure the project is following the guidelines
 
+# after labeler, run other actions with strict permissions
 name: CI
 
 on:
-  pull_request:
+  workflow_run:
+    workflows: [Labeler]
+    types: [completed]
     branches: ["*"]
 
 env:
@@ -19,18 +22,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  labeler:
-    name: Label PR
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/labeler@v4
-        with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
-          sync-labels: true
-
   lint:
     runs-on: ubuntu-latest
     name: Run ESLint