only run labelers for core team (#3426)

* use `pull_request_target` instead of `pull_request`

* adjust

* only run for core team

.github/workflows/pull-request-commit.yml

@@ -13,13 +13,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  pull-requests: write
+  actions: write
+  contents: read
+
 jobs:
   webpack-analyzer:
     runs-on: ubuntu-22.04
-    if: ${{ github.event_name == 'pull_request' }}
-    permissions:
-      pull-requests: write
-      actions: write
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v4
@@ -94,11 +96,8 @@ jobs:
 
   test-suite-fingerprint:
     runs-on: ubuntu-22.04
-    if: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push' }}
     concurrency: fingerprint-${{ github.event_name != 'pull_request' && 'main' || github.run_id }}
-    permissions:
-      pull-requests: write
-      actions: write
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v4