[DylanVolz]

Description

When the tests: run label is added to a fork PR (including Renovate PRs from renovate-bot), conformance.yml triggers on pull_request_target: types: [labeled] to remove the one-shot tests: run label, and previously attempted to check out the fork PR's SHA and build/run ./toolbox in that same pull_request_target job.

Starting in actions/checkout@v7.0.0, actions/checkout blocks checking out fork PR code inside a pull_request_target workflow (Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow), causing the pull_request_target conformance run to fail and overwrite the passing pull_request conformance check.

This PR aligns conformance.yml with #2671 by:
- Isolating the tests: run label cleanup into a dedicated remove-label job (pull_request_target) that never checks out code.
- Running the conformance job exclusively on pull_request with contents: read permissions.

PR Checklist

Thank you for opening a Pull Request! Before submitting your PR, there are a
few things you can do to make sure it goes smoothly:

• Make sure you reviewed
  CONTRIBUTING.md
• Make sure to open an issue as a
  bug/issue
  before writing your code! That way we can discuss the change, evaluate
  designs, and agree on the general idea
• Ensure you have manually reviewed the entire diff before requesting a
  review
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)
• Make sure to add ! if this involve a breaking change

🛠️ Fixes #<issue_number_goes_here>

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[DylanVolz]

/gcbrun