We do this because the GitHub Actions behavior was changed recently
so as to not pass secrets to action runs started from forks, therefore
the API token passed cannot be used to change PR labels.

There may be an alternative in the future.