Run the provenance workflow post merge or if explicitly labeled to (p…

…roject-oak#4064)

* Run the provenance workflow post merge or if explicitly labeled to
  Tested that
  1. It runs the provenance workflow if PR has the specified label
  2. It does not run the workflow if the PR does not have the label

.github/workflows/provenance.yaml

@@ -9,16 +9,16 @@ on:
   push:
     branches: [main]
   # This workflow builds several binaries and is very time and resource consuming. As a result it
-  # disabled disabled by default on pull-request events. If you need to test this workflow on your
-  # PR before merge, label it with `provenance:force-run` to trigger the workflow.
+  # is disabled by default on pull-request events. If you need to test this workflow on your PR
+  # before merge, label it with `provenance:force-run` to trigger the workflow.
   pull_request:
     branches: [main]
 
 jobs:
   build_binary:
     if: |
       github.event_name == 'push' ||
-      github.event_name == 'pull-request' && ${{ contains(github.event.pull_request.labels.*.name, 'provenance:force-run') }}
+      contains(github.event.pull_request.labels.*.name, 'provenance:force-run')
     # We use the same job template to generate provenances for multiple binaries.
     strategy:
       fail-fast: false