make hold and pr-label workflows reusable

.github/workflows/hold.yml

@@ -1,16 +1,26 @@
 # Blocks merge when the "do-not-merge/hold" label is applied to a PR.
 #
-# Uses pull_request_target so the label event from forks also triggers this
-# check. This workflow does NOT check out or execute PR code — do not add
-# actions/checkout of the PR head ref or run steps that reference
+# Reusable workflow. Consumer repos wrap it with their own trigger workflow:
+#
+#   # .github/workflows/hold.yml in the consumer repo
+#   name: "Hold"
+#   on:
+#     pull_request_target:
+#       types: [opened, reopened, synchronize, labeled, unlabeled]
+#     merge_group:
+#   jobs:
+#     hold:
+#       uses: generative-computing/.github/.github/workflows/hold.yml@main
+#
+# Uses pull_request_target in the caller so the label event from forks also
+# triggers this check. This workflow does NOT check out or execute PR code —
+# do not add actions/checkout of the PR head ref or run steps that reference
 # PR-controlled files.
 
 name: "Hold"
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types: [opened, reopened, synchronize, labeled, unlabeled]
-  merge_group:
+  workflow_call:
 
 permissions: {}
 

.github/workflows/pr-label.yml

@@ -1,6 +1,18 @@
-# This workflow uses pull_request_target, which grants write access to
-# the repo even for PRs from forks. This is safe ONLY because it never checks
-# out or executes code from the PR branch. Do NOT add:
+# Reusable workflow. Consumer repos wrap it with their own trigger workflow:
+#
+#   # .github/workflows/pr-label.yml in the consumer repo
+#   name: "Label PR by conventional commit prefix"
+#   on:
+#     pull_request_target:
+#       types: [opened, edited, synchronize]
+#     merge_group:
+#   jobs:
+#     label:
+#       uses: generative-computing/.github/.github/workflows/pr-label.yml@main
+#
+# The caller uses pull_request_target, which grants write access to the repo
+# even for PRs from forks. This is safe ONLY because this workflow never
+# checks out or executes code from the PR branch. Do NOT add:
 #   - actions/checkout (of the PR head ref)
 #   - run: steps that reference PR-controlled files
 #   - any step that executes code from the pull request
@@ -9,9 +21,7 @@
 name: "Label PR by conventional commit prefix"
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types: [opened, edited, synchronize]
-  merge_group:
+  workflow_call:
 
 jobs:
   label: