Fix GitHub workflow conditionals (#2489)

BUG=b/327686165
diff --git a/.github/workflows/cortex_m.yml b/.github/workflows/cortex_m.yml
index 9ea5a9a..6204a50 100644
--- a/.github/workflows/cortex_m.yml
+++ b/.github/workflows/cortex_m.yml
@@ -18,7 +18,7 @@
     types:
       - closed
       - labeled
-  
+
   workflow_call:
     inputs:
       trigger-sha:
@@ -34,13 +34,15 @@
 
     if: |
       github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'schedule' && github.repository == 'tensorflow/tflite-micro') ||
-      contains(github.event.pull_request.labels.*.name, 'ci:run_full')
+      (github.event_name == 'schedule' &&
+       github.repository == 'tensorflow/tflite-micro') ||
+      (github.event.action == 'labeled' &&
+       github.event.label.name == 'ci:run_full')
 
     name: Cortex-M Generic
     steps:
       - uses: actions/setup-python@v4
-        with: 
+        with:
           python-version: '3.10'
       - uses: actions/checkout@v2
       - name: Install dependencies
@@ -57,13 +59,15 @@
 
     if: |
       github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'schedule' && github.repository == 'tensorflow/tflite-micro') ||
-      contains(github.event.pull_request.labels.*.name, 'ci:run_full')
+      (github.event_name == 'schedule' &&
+       github.repository == 'tensorflow/tflite-micro') ||
+      (github.event.action == 'labeled' &&
+       github.event.label.name == 'ci:run_full')
 
     name: Cortex-M Corstone 300 (FVP)
     steps:
       - uses: actions/setup-python@v4
-        with: 
+        with:
           python-version: '3.10'
       - uses: actions/checkout@v2
       - name: Install dependencies
diff --git a/.github/workflows/tests_entry.yml b/.github/workflows/tests_entry.yml
index 07cf617..f2a5519 100644
--- a/.github/workflows/tests_entry.yml
+++ b/.github/workflows/tests_entry.yml
@@ -28,9 +28,10 @@
     runs-on: ubuntu-latest
     steps:
       - name: fail-without-labels
-        if: ${{ !(contains(github.event.pull_request.labels.*.name, 'ci:run') ||
-          contains(github.event.pull_request.labels.*.name, 'ci:ready_to_merge') ||
-          contains(github.event.pull_request.labels.*.name, 'ci:run_full')) }}
+        if: github.event.action == 'labeled' &&
+          !(github.event.label.name == 'ci:run' ||
+            github.event.label.name == 'ci:ready_to_merge' ||
+            github.event.label.name = 'ci:run_full')
         run: exit 1
 
   ci-ready-to-merge:
@@ -60,7 +61,8 @@
     needs: ci-ready-to-merge
     steps:
       - name: remove-cirun
-        if: ${{ contains(github.event.pull_request.labels.*.name, 'ci:run') }}
+        if: github.event.action == 'labeled' &&
+            github.event.label.name == 'ci:run'
         uses: actions/github-script@v5
         with:
           github-token: ${{ secrets.TFLM_BOT_REPO_TOKEN }}
@@ -78,7 +80,8 @@
     needs: ci-run
     steps:
       - name: remove-cirun-full
-        if: ${{ contains(github.event.pull_request.labels.*.name, 'ci:run_full') }}
+        if: github.event.action == 'labeled' &&
+            github.event.label.name = 'ci:run_full'
         uses: actions/github-script@v5
         with:
           github-token: ${{ secrets.TFLM_BOT_REPO_TOKEN }}
@@ -102,7 +105,7 @@
           echo "PR description requires a BUG= line with issue number."
           echo "See https://testing.googleblog.com/2017/09/code-health-providing-context-with.html for additional context"
           exit 1
-  
+
   call-ci:
     needs: ci-run
     uses: ./.github/workflows/ci.yml
@@ -128,7 +131,7 @@
   call-check-tflite-files:
     needs: ci-run
     uses: ./.github/workflows/check_tflite_files.yml
-    with: 
+    with:
       trigger-sha: ${{ github.event.pull_request.head.sha }}
       pr-number: ${{ github.event.pull_request.number }}
       pr-body: ${{ github.event.pull_request.body }}
diff --git a/.github/workflows/tests_post.yml b/.github/workflows/tests_post.yml
index 91c1946..7e86f5e 100644
--- a/.github/workflows/tests_post.yml
+++ b/.github/workflows/tests_post.yml
@@ -12,8 +12,9 @@
 
 jobs:
   riscv_postmerge:
-    if: ${{ github.event.pull_request.merged == true ||
-      contains(github.event.pull_request.labels.*.name, 'ci:run_full') }}
+    if: github.event.pull_request.merged == true ||
+        (github.event.action == 'labeled' &&
+         github.event.label.name == 'ci:run_full')
     uses: ./.github/workflows/riscv_postmerge.yml
     with:
       trigger-sha: ${{ github.event.pull_request.head.sha }}
@@ -21,8 +22,9 @@
       tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
 
   xtensa_postmerge:
-    if: ${{ github.event.pull_request.merged == true ||
-            contains(github.event.pull_request.labels.*.name, 'ci:run_full') }}
+    if: github.event.pull_request.merged == true ||
+        (github.event.action == 'labeled' &&
+         github.event.label.name == 'ci:run_full')
     uses: ./.github/workflows/xtensa_postmerge.yml
     with:
       trigger-sha: ${{ github.event.pull_request.head.sha }}
@@ -30,7 +32,8 @@
       tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
 
   cortex_m_ci_full:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ci:run_full') }}
+    if: github.event.action == 'labeled' &&
+         github.event.label.name == 'ci:run_full'
     uses: ./.github/workflows/cortex_m.yml
     with:
       trigger-sha: ${{ github.event.pull_request.head.sha }}
@@ -38,7 +41,7 @@
       tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
 
   issue_on_error:
-    needs: [riscv_postmerge,xtensa_postmerge,cortex_m_ci_full]
+    needs: [riscv_postmerge, xtensa_postmerge, cortex_m_ci_full]
     if: ${{ always() && contains(needs.*.result, 'failure') &&
             !contains(github.event.pull_request.labels.*.name, 'ci:run_full') }}
     uses: ./.github/workflows/issue_on_error.yml
@@ -58,7 +61,8 @@
     runs-on: ubuntu-latest
     steps:
       - name: remove-cirun-full
-        if: ${{ contains(github.event.pull_request.labels.*.name, 'ci:run_full') }}
+        if: github.event.action == 'labeled' &&
+            github.event.label.name == 'ci:run_full'
         uses: actions/github-script@v5
         with:
           github-token: ${{ secrets.TFLM_BOT_REPO_TOKEN }}
@@ -70,4 +74,3 @@
               name: 'ci:run_full'
             })
         continue-on-error: true
-