Add CredentialIssuer service labels to impersonator Services - #3235

On November 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/create-github-app-token@v1, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Cache reservation failed: cache write denied: token has no writable scopes

📥 API Fetch: vmware/.github/data/licenses_all.json

✅ Allowlist loaded via API. Found 1 DCO-only repos.

📥 API Fetch: vmware/.github/cla/allowlist.yml

-> NOTE: 404 means 'Not Found'.

❌ GitHub API error: 404 - Not Found

🕵️ Checking membership for @0hlov3 in vmware...

🔍 Checking PR #3235 by @0hlov3...

--- STARTING COMPLIANCE ENGINE (EVENT MODE) ---

[AUTH] ✅ Token Upgrade Successful!

[AUTH] Checking for available credentials to upgrade token...