test if repo checkout fetches the correct config

.github/labeler.yml

@@ -1,44 +1,35 @@
 server:
   - changed-files:
-      - any-glob-to-any-file:
-          - src/main/java/**/*.java
+      - any-glob-to-any-file: src/main/java/**/*.java
 
 client:
   - changed-files:
-      - any-glob-to-any-file:
-          - src/main/webapp/**/*
+      - any-glob-to-any-file: src/main/webapp/**/*
 
 tests:
   - changed-files:
-      - any-glob-to-any-file:
-          - src/test/**/*
+      - any-glob-to-any-file: src/test/**/*
 
 cypress:
   - changed-files:
-      - any-glob-to-any-file:
-          - src/test/cypress/**/*
+      - any-glob-to-any-file: src/test/cypress/**/*
 
 database:
   - changed-files:
-      - any-glob-to-any-file:
-          - src/main/resources/config/liquibase/master.xml
+      - any-glob-to-any-file: src/main/resources/config/liquibase/master.xml
 
 documentation:
   - changed-files:
-      - any-glob-to-any-file:
-          - docs/**/*
+      - any-glob-to-any-file: docs/**/*
 
 docker:
   - changed-files:
-      - any-glob-to-any-file:
-          - docker/**/*
+      - any-glob-to-any-file: docker/**/*
 
 config-change:
   - changed-files:
-      - any-glob-to-any-file:
-          src/main/resources/config/*.yml
+      - any-glob-to-any-file: src/main/resources/config/*.yml
 
 template:
   - changed-files:
-      - any-glob-to-any-file:
-          - src/main/resources/templates/**/*
+      - any-glob-to-any-file: src/main/resources/templates/**/*

.github/workflows/pullrequest-labeler.yml

@@ -3,8 +3,12 @@ on: [pull_request_target]
 
 jobs:
   label:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v4
       - uses: actions/labeler@v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"