Do not auto-label fork pull requests

A ciflow label makes pytorchbot tag the PR head in this repo, and a tag push
runs the workflow file from that commit -- the fork's copy -- with this repo's
secrets and OIDC. Applying the label automatically therefore hands fork code
role/arc, which can now write to ECR. Requiring a maintainer to label a fork PR
is the trust gate pytorch relies on.

This also closes the same path for ciflow/trunk, which the arm rules already
auto-applied to fork PRs. The cost is that fork PRs no longer get the
informational module labels either.

Authored with Claude Code.

Author: huydhn

.github/workflows/labeler.yml

@@ -9,6 +9,11 @@ permissions:
 
 jobs:
   label:
+    # A ciflow label makes pytorchbot tag the PR head in this repo, and a tag
+    # push runs the workflow from that commit with this repo's secrets. Applying
+    # one to a fork PR automatically would hand fork code those secrets, so fork
+    # PRs are left to a maintainer.
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@v5