feat: Enhance pull request handling with trust helper (gardener#342)

Author: hebelsan

.github/workflows/non-release.yaml

@@ -1,10 +1,22 @@
 name: Build
 on:
   push:
+    branches:
+      - 'master'
+      - 'rel-*'
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
   pull_request_target:
+    types:
+      - labeled
 
 jobs:
   build:
+    if: ${{ github.event_name != 'pull_request_target' || (github.event_name == 'pull_request_target' && github.event.label.name == 'reviewed/ok-to-test') }}
     uses: ./.github/workflows/build.yaml
     with:
       mode: snapshot
@@ -15,6 +27,7 @@ jobs:
       id-token: write
 
   component-descriptor:
+    if: ${{ github.event_name != 'pull_request_target' || (github.event_name == 'pull_request_target' && github.event.label.name == 'reviewed/ok-to-test') }}
     uses: gardener/cc-utils/.github/workflows/post-build.yaml@master
     needs:
       - build

.github/workflows/pullrequest-trust-helper.yaml

@@ -0,0 +1,16 @@
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+
+jobs:
+  pullrequest-trusted-helper:
+    permissions:
+      pull-requests: write
+    secrets: inherit # access to `GitHub-Actions`-App is needed to read teams
+    uses: gardener/cc-utils/.github/workflows/pullrequest-trust-helper.yaml@master
+    with:
+      trusted-teams: 'mcm-maintainers,gardener-extension-provider-openstack-maintainers'