Add 'automated code review' label after PR creation, using GITHUB_TOKEN

When a PR is created with `gh pr create --label ...` (via the otelbot app token in code-review-sweep.yml), GitHub fires `opened` and `labeled` pull_request events within the same second. Both runs land in the build-pull-request.yml concurrency group with cancel-in-progress, so the (skipped, label-not-build-relevant) labeled run cancels the real opened run, leaving the PR with no build and a failing required-status-check (see e.g. PR #18441).

Split into two steps: create the PR (otelbot app token, so the PR is authored by otelbot), then add the label as a separate step using the default GITHUB_TOKEN. GitHub's anti-recursion rule means actions taken with GITHUB_TOKEN don't trigger workflow events, so adding the label no longer fires a labeled pull_request event and the build for the PR is no longer cancelled.

Author: trask

.github/workflows/code-review-sweep.yml

@@ -63,6 +63,7 @@ jobs:
     environment: protected
     permissions:
       contents: write  # for git push
+      pull-requests: write  # for adding the "automated code review" label via GITHUB_TOKEN
     env:
       MODULES_JSON: ${{ needs.dispatch.outputs.modules }}
       MODEL: ${{ needs.dispatch.outputs.model }}
@@ -179,17 +180,36 @@ jobs:
 
       - name: Create PR
         if: steps.commit.outputs.pushed == 'true'
+        id: create-pr
         env:
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           branch="${{ steps.branch.outputs.name }}"
           title="Code review sweep (run ${GITHUB_RUN_ID})"
+          # Create the PR without the label. Adding `--label` here uses the
+          # otelbot app token, which fires a `labeled` pull_request event in
+          # the same second as the `opened` event. Both runs land in the same
+          # concurrency group on build-pull-request.yml with cancel-in-progress,
+          # so the (skipped) labeled run cancels the real opened run and the
+          # PR ends up with no build (see PR #18441).
           gh pr create \
             --title "$title" \
             --body-file "$PR_BODY" \
             --base main \
-            --head "$branch" \
-            --label "automated code review"
+            --head "$branch"
+
+      - name: Add label to PR
+        if: steps.commit.outputs.pushed == 'true'
+        env:
+          # Use the default GITHUB_TOKEN (not the otelbot app token) so that
+          # adding the label does NOT trigger downstream workflows. GitHub's
+          # anti-recursion rule: actions taken with GITHUB_TOKEN don't fire
+          # workflow events. This avoids the labeled-vs-opened race that
+          # would otherwise cancel the build for this PR.
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          branch="${{ steps.branch.outputs.name }}"
+          gh pr edit "$branch" --add-label "automated code review"
 
       - name: Ensure progress branch exists
         if: steps.review-loop.outputs.processed_count != '0'