Alternative solution for ensuring it runs in the repo

Author: marcpopMSFT

.github/workflows/add-lockdown-label.yml

@@ -1,8 +1,13 @@
 name: Add Branch Lockdown Label to PRs
 
 on:
-  pull_request:
+  pull_request_target:
   workflow_dispatch: # Allows manual triggering of the workflow
+    branches:
+      - 'release/8.*'
+      - 'release/9.*'
+      - 'release/10.*'
+      - 'main'
 
 permissions:
   actions: write # For managing the operation state cache
@@ -11,6 +16,8 @@ permissions:
 jobs:
   add-label:
     runs-on: ubuntu-latest
+    # Only run on the main repository, not forks
+    if: github.repository == 'dotnet/sdk'
 
     permissions:
       contents: read