Move removing the chromatic label to a trusted workflow (#3841)

.github/workflows/build-storybook.yml

@@ -4,16 +4,12 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
+    types: [opened, synchronize, reopened, labeled]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  issues: write
-  pull-requests: write
-
 jobs:
   build-storybook:
     runs-on: ubuntu-latest
@@ -45,25 +41,16 @@ jobs:
           echo $BASE > ./METADATA/base
           echo $RUN_CHROMATIC > ./METADATA/run-chromatic
           echo $NO_TURBOSNAP > ./METADATA/no-turbosnap
+          echo $ISSUE_NUMBER > ./METADATA/issue-number
         env:
           DRAFT: ${{ github.event.pull_request.draft }}
           BRANCH_NAME: ${{ github.event.pull_request.head.label || github.ref_name }}
           BASE: ${{ github.event.pull_request.base.ref || github.ref_name }}
           RUN_CHROMATIC: ${{ contains(github.event.pull_request.labels.*.name, 'chromatic') }}
           NO_TURBOSNAP: ${{ contains(github.event.pull_request.labels.*.name, 'no turbosnap') }}
+          ISSUE_NUMBER: ${{ github.event.pull_request.number }}
       - uses: actions/upload-artifact@v4
         with:
           name: metadata
           path: ./METADATA
           retention-days: 1
-      - name: Remove Chromatic label
-        uses: actions/github-script@v7
-        if: contains(github.event.pull_request.labels.*.name, 'chromatic')
-        with:
-          script: |
-            await github.rest.issues.removeLabel({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              name: ["chromatic"]
-            });

.github/workflows/chromatic.yml

@@ -6,6 +6,10 @@ on:
     types:
       - completed
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   chromatic-deployment:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
@@ -43,6 +47,9 @@ jobs:
 
             const noTurbosnap = fs.readFileSync("./METADATA/no-turbosnap", "utf8").trim();
             core.setOutput("noTurbosnap", noTurbosnap);
+
+            const issueNumber = fs.readFileSync("./METADATA/issue-number", "utf8").trim();
+            core.setOutput("issueNumber", issueNumber);
       - name: Fetch base branch from upstream
         if: github.event.workflow_run.event == 'pull_request'
         run: |
@@ -85,3 +92,17 @@ jobs:
           debug: true
         env:
           LOG_LEVEL: "debug"
+      - name: Remove Chromatic label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            try {
+              await github.rest.issues.removeLabel({
+                issue_number: ${{ steps.chromatic_branch.outputs.issueNumber }},
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: ["chromatic"]
+              });
+            } catch (error) {
+              console.log(error);
+            }