chore: add contributor label for callstack-internal org

Author: satya164

.github/workflows/contributor-label.yml

@@ -6,46 +6,74 @@ on:
 
 permissions:
   issues: write
-  pull-requests: write
 
 jobs:
   label:
     name: Add contributor label
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.ORG_MEMBERSHIP_APP_ID }}
+          private-key: ${{ secrets.ORG_MEMBERSHIP_APP_PRIVATE_KEY }}
+          owner: callstack-internal
+          permission-members: read
+
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          ORG_MEMBERSHIP_TOKEN: ${{ steps.app-token.outputs.token }}
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const owner = context.repo.owner;
             const repo = context.repo.repo;
 
-            let permission = 'none';
+            const label = 'Contributor: Internal';
+
+            const pullRequest = context.payload.pull_request;
+
+            if (pullRequest.labels.some(({ name }) => name === label)) {
+              return;
+            }
+
+            const username = pullRequest.user.login;
 
-            try {
-              const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+            const { data } =
+              await github.rest.repos.getCollaboratorPermissionLevel({
                 owner,
                 repo,
-                username: context.payload.pull_request.user.login,
+                username,
               });
 
-              permission = data.permission;
-            } catch (error) {
-              if (error.status !== 404) {
-                throw error;
+            let isInternal =
+              ['MEMBER', 'OWNER'].includes(pullRequest.author_association) ||
+              ['admin', 'maintain', 'write'].includes(data.permission);
+
+            if (!isInternal) {
+              try {
+                const internalGithub = getOctokit(process.env.ORG_MEMBERSHIP_TOKEN);
+
+                await internalGithub.rest.orgs.checkMembershipForUser({
+                  org: 'callstack-internal',
+                  username,
+                });
+
+                isInternal = true;
+              } catch (error) {
+                if (error.status !== 404) {
+                  throw error;
+                }
               }
             }
 
-            if (
-              !['MEMBER', 'OWNER'].includes(context.payload.pull_request.author_association) &&
-              !['admin', 'maintain', 'write'].includes(permission)
-            ) {
+            if (!isInternal) {
               return;
             }
 
             await github.rest.issues.addLabels({
               owner,
               repo,
-              issue_number: context.issue.number,
-              labels: ['Contributor: Internal'],
+              issue_number: pullRequest.number,
+              labels: [label],
             });