From 58d9558fa2f2c083e5ff68fc2af8a8083f2ce125 Mon Sep 17 00:00:00 2001
From: Przemek Tredak <ptredak@nvidia.com>
Date: Thu, 21 May 2026 14:11:26 -0700
Subject: [PATCH 1/4] Debugging

Signed-off-by: Przemek Tredak <ptredak@nvidia.com>
---
 .github/workflows/community_label.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/community_label.yml b/.github/workflows/community_label.yml
index c09debb87f..8d87c344b8 100644
--- a/.github/workflows/community_label.yml
+++ b/.github/workflows/community_label.yml
@@ -24,6 +24,8 @@ jobs:
             const pr = context.payload.pull_request;
             const user = pr.user.login;
             const association = pr.author_association;
+            console.log("user", user);
+            console.log("association", association);
 
             const communityLabel = "community-contribution";
             const orgLabel = "org-contribution";
@@ -32,6 +34,7 @@ jobs:
 
             const isOrgMember =
               association === "MEMBER" || association === "OWNER";
+            console.log("isOrgMember:", isOrgMember);
 
             if (!isOrgMember) {
               targetLabel = communityLabel;
@@ -50,6 +53,7 @@ jobs:
               }
 
               const isCore = permission === "write" || permission === "admin";
+              console.log("isCore: ", isCore);
 
               if (!isCore) {
                 targetLabel = orgLabel;

From 96579c6c6f85692e2a15d2fc173ee94e4befddf7 Mon Sep 17 00:00:00 2001
From: Przemek Tredak <ptredak@nvidia.com>
Date: Thu, 21 May 2026 14:15:18 -0700
Subject: [PATCH 2/4] More debugging

Signed-off-by: Przemek Tredak <ptredak@nvidia.com>
---
 .github/workflows/community_label.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/community_label.yml b/.github/workflows/community_label.yml
index 8d87c344b8..5f2382854a 100644
--- a/.github/workflows/community_label.yml
+++ b/.github/workflows/community_label.yml
@@ -6,7 +6,7 @@
 name: Label community contributions
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, reopened, ready_for_review, synchronize]
 
 permissions:

From 76b2cea296b930045e13ad689a07cdad69260e34 Mon Sep 17 00:00:00 2001
From: Przemek Tredak <ptredak@nvidia.com>
Date: Thu, 21 May 2026 15:08:52 -0700
Subject: [PATCH 3/4] Distinguish the users based on the write permissions
 rather than relying on the member field, which could be set to private

Signed-off-by: Przemek Tredak <ptredak@nvidia.com>
---
 .github/workflows/community_label.yml | 41 +++++++++++----------------
 1 file changed, 17 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/community_label.yml b/.github/workflows/community_label.yml
index 5f2382854a..000acadefb 100644
--- a/.github/workflows/community_label.yml
+++ b/.github/workflows/community_label.yml
@@ -6,7 +6,7 @@
 name: Label community contributions
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, ready_for_review, synchronize]
 
 permissions:
@@ -24,8 +24,6 @@ jobs:
             const pr = context.payload.pull_request;
             const user = pr.user.login;
             const association = pr.author_association;
-            console.log("user", user);
-            console.log("association", association);
 
             const communityLabel = "community-contribution";
             const orgLabel = "org-contribution";
@@ -34,33 +32,28 @@ jobs:
 
             const isOrgMember =
               association === "MEMBER" || association === "OWNER";
-            console.log("isOrgMember:", isOrgMember);
 
+            let permission = "none";
+
+            try {
+              const res = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: user,
+              });
+              permission = res.data.permission;
+            } catch (e) {
+              if (e.status !== 404) throw e;
+            }
+
+            const isCore = permission === "write" || permission === "admin";
             if (!isOrgMember) {
               targetLabel = communityLabel;
             } else {
-              let permission = "none";
-
-              try {
-                const res = await github.rest.repos.getCollaboratorPermissionLevel({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  username: user,
-                });
-                permission = res.data.permission;
-              } catch (e) {
-                if (e.status !== 404) throw e;
-              }
-
-              const isCore = permission === "write" || permission === "admin";
-              console.log("isCore: ", isCore);
-
-              if (!isCore) {
-                targetLabel = orgLabel;
-              }
+              targetLabel = orgLabel;
             }
 
-            if (targetLabel) {
+            if (targetLabel && !isCore) {
               await github.rest.issues.addLabels({
                 owner: context.repo.owner,
                 repo: context.repo.repo,

From 835871a33cbda54c251784c345fcdbfc1e99cbcb Mon Sep 17 00:00:00 2001
From: Przemek Tredak <ptredak@nvidia.com>
Date: Thu, 21 May 2026 15:36:44 -0700
Subject: [PATCH 4/4] Fix

Signed-off-by: Przemek Tredak <ptredak@nvidia.com>
---
 .github/workflows/community_label.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/community_label.yml b/.github/workflows/community_label.yml
index 000acadefb..c0d31d2a45 100644
--- a/.github/workflows/community_label.yml
+++ b/.github/workflows/community_label.yml
@@ -53,7 +53,7 @@ jobs:
               targetLabel = orgLabel;
             }
 
-            if (targetLabel && !isCore) {
+            if (!isCore) {
               await github.rest.issues.addLabels({
                 owner: context.repo.owner,
                 repo: context.repo.repo,