pull_request_target?

Author: Happypig375

.github/workflows/Label.yml

@@ -1,20 +1,19 @@
 name: Label breaking changes for semantic versioning
 
-on: [pull_request]
+on: [pull_request_target] # run on the merge target branch instead of the merge commit to grant pull-requests:write permission
 jobs:
   Label:
     runs-on: windows-latest
     permissions:
       pull-requests: write # allow adding a label to this pull request
     steps:
     - uses: actions/checkout@v6
-      with:
-        submodules: recursive
-        fetch-depth: 0 # fetch all commit history across all branches and tags, instead of only one commit by default
     - name: If there are changes in PublicApi.Shipped.txt, fail the workflow
       if: github.head_ref != 'action/ship-publicapi' # Same branch name specified in Release.yml
       run: |
-        $changes = git diff --numstat --shortstat origin/${{ github.base_ref }}...${{ github.sha }} -- '**/PublicApi.Shipped.txt'
+        $head = git rev-parse HEAD
+        Write-Output "HEAD is $head"
+        $changes = git diff --numstat --shortstat HEAD..${{ github.sha }} -- '**/PublicApi.Shipped.txt'
         Write-Output "$changes"
         if ($changes) {
           Write-Error "Changes detected in PublicApi.Shipped.txt files. Public API changes must be shipped through the release process, not in regular pull requests."
@@ -29,7 +28,7 @@ jobs:
           Write-Output "This is a ship-publicapi PR, labeling as Type/Maintenance"
         } else {
           # For regular PRs, check for API changes
-          $changes = git diff origin/${{ github.base_ref }}...${{ github.sha }} -- '**/PublicApi.Unshipped.txt'
+          $changes = git diff HEAD..${{ github.sha }} -- '**/PublicApi.Unshipped.txt'
           Write-Output "$changes"
           
           if ($changes) {