Address peer review: Replace 'pull_request_target' with a schedule for the external review labeler workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: andersfugmann

.github/workflows/label-external-contributions.yml

@@ -1,62 +1,80 @@
 name: Label external contributions
 
 on:
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-      - ready_for_review
+  schedule:
+    - cron: "7,22,37,52 * * * *"
+  workflow_dispatch:
 
 permissions: {}
 
+concurrency:
+  group: label-external-contributions
+  cancel-in-progress: false
+
 jobs:
   label:
-  # Label non-draft PRs from personal accounts that are not owning (github) organization members or owners,
-  # including outside collaborators and prior contributors. GitHub organization members are excluded, and bot accounts too.
-    if: >-
-      github.event.pull_request.draft == false &&
-      github.event.pull_request.user.type == 'User' &&
-      github.event.pull_request.author_association != 'MEMBER' &&
-      github.event.pull_request.author_association != 'OWNER'
+    if: github.ref_name == github.event.repository.default_branch
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     permissions:
-      issues: write
-    concurrency:
-      group: label-external-contribution-${{ github.event.pull_request.number }}
-      cancel-in-progress: false
+      pull-requests: write
 
     steps:
-      - name: Add external contribution label
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ github.token }}
-          script: |
-            const label = 'external-contribution';
-            const pullRequest = context.payload.pull_request;
-
-            if (pullRequest.labels.some(({ name }) => name === label)) {
-              return;
-            }
-
-            const events = await github.paginate(
-              github.rest.issues.listEvents,
-              {
-                ...context.repo,
-                issue_number: pullRequest.number,
-                per_page: 100,
-              },
-            );
-            if (
-              events.some(({ event, label: eventLabel }) =>
-                event === 'unlabeled' && eventLabel?.name === label
-              )
-            ) {
-              return;
-            }
-
-            await github.rest.issues.addLabels({
-              ...context.repo,
-              issue_number: pullRequest.number,
-              labels: [label],
-            });
+      - name: Label external contributions
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          label="external-contribution"
+          updated_cutoff=$(date -u -d "1 hour ago" "+%Y-%m-%dT%H:%M:%SZ")
+
+          while IFS= read -r pr_number; do
+            if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]]; then
+              echo "Skipping malformed pull request number."
+              continue
+            fi
+
+            pr_json=$(gh api "repos/$REPO/pulls/$pr_number")
+            if ! jq -e \
+              --arg repo "$REPO" \
+              --arg label "$label" \
+              '.state == "open" and
+               .draft == false and
+               .base.repo.full_name == $repo and
+               (.head.repo.full_name | type == "string") and
+               .head.repo.full_name != $repo and
+               .user.type == "User" and
+               .author_association != "MEMBER" and
+               .author_association != "OWNER" and
+               (any(.labels[]?; .name == $label) | not)' \
+              >/dev/null <<<"$pr_json"; then
+              continue
+            fi
+
+            events=$(gh api --paginate \
+              "repos/$REPO/issues/$pr_number/events?per_page=100" |
+              jq -cs 'add')
+
+            if jq -e --arg label "$label" \
+              'any(.[]; .event == "labeled" and .label.name == $label)' \
+              >/dev/null <<<"$events"; then
+              continue
+            fi
+
+            jq -n --arg label "$label" '{labels: [$label]}' |
+              gh api --method POST \
+                "repos/$REPO/issues/$pr_number/labels" \
+                --input - \
+                >/dev/null
+            echo "Labelled pull request #$pr_number."
+          done < <(
+            gh api --method GET --paginate "repos/$REPO/issues" \
+              -f state=open \
+              -f since="$updated_cutoff" \
+              -f sort=updated \
+              -f direction=desc \
+              -f per_page=100 |
+              jq -r '.[] | select(.pull_request != null) | .number'
+          )