fix(ci): gate type labels for trusted PRs

[JSONbored]

Motivation

• Prevent untrusted fork PR authors from using pull_request_target runs to cause privileged repository label writes based on attacker-controlled PR titles.
• Preserve label-integrity for downstream scoring by only allowing deterministic type-labeling for trusted actors or same-repository PRs.
• Reduce workflow privileges by removing unused write permissions that could be abused by fork-triggered runs.

Description

• Add isTrustedPullRequestForLabeling which returns true for author_association values OWNER, MEMBER, or COLLABORATOR, or when the PR head.repo.full_name equals the base.repo.full_name (same-repo PRs).
• Gate pull_request_target handling in getTypeLabelDecision to skip with reason untrusted-pull-request-author for untrusted PRs and short-circuit shouldFetchReferencedIssues to avoid authenticated fetches for untrusted forks.
• Remove the unnecessary pull-requests: write permission from .github/workflows/type-label.yml while keeping issues: write for legitimate label operations.
• Add focused unit tests in test/unit/github-type-label.test.ts covering trusted-author labeling, skipping untrusted fork PRs, same-repository PR behavior, and avoiding issue fetches for untrusted forks.

Testing

• Ran git diff --check which completed without issues.
• Ran unit tests with npm test -- --run test/unit/github-type-label.test.ts and all tests in that file passed (30 passed).
• Ran TypeScript checks with npm run typecheck which completed successfully.
• Ran npm run actionlint as part of validation which completed (using fallback tooling) without failing the change.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	17fdd0e	Commit Preview URL Branch Preview URL	Jun 10 2026, 06:26 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#490 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.