Would you approve this PR label workflow?

Situation

A teammate proposes a workflow that labels new pull requests using an internal bot script.

Environment

GitHub Actions on a repository that receives external contributions.

Select suspicious lines in the terminal to flag them before submitting your verdict.

pending review

name: label-pr
on:
  pull_request_target:
    types: [opened]
jobs:
  label:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - run: npm ci
      - run: node ./scripts/label-bot.js