From d9a084aafae5cde89d5c250a756023e3ddc54489 Mon Sep 17 00:00:00 2001
From: Brandon Harvey <8107750+bharvey88@users.noreply.github.com>
Date: Thu, 23 Jul 2026 11:04:14 -0500
Subject: [PATCH] Pin shared workflows to a commit SHA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The reusable workflows from ApolloAutomation/Workflows ran from the
mutable main ref, including in pull_request_target contexts with write
tokens. Pin all five references to the current reviewed commit.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 .github/workflows/autoassign.yml  | 2 +-
 .github/workflows/build.yml       | 2 +-
 .github/workflows/ci.yml          | 2 +-
 .github/workflows/label-check.yml | 2 +-
 .github/workflows/weekly.yml      | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/autoassign.yml b/.github/workflows/autoassign.yml
index be0b7f4..6f34643 100644
--- a/.github/workflows/autoassign.yml
+++ b/.github/workflows/autoassign.yml
@@ -16,7 +16,7 @@ jobs:
   auto-assign:
     # Skip auto-assign for pull requests from forks due to GITHUB_TOKEN permission restrictions
     if: github.event_name == 'issues' || github.event.pull_request.head.repo.full_name == github.repository
-    uses: ApolloAutomation/Workflows/.github/workflows/autoassign.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/autoassign.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23
     with:
       assignees: bharvey88
       num-of-assignees: 1
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 65772a2..2ddfc5b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,7 +16,7 @@ on:
 
 jobs:
   build-and-publish:
-    uses: ApolloAutomation/Workflows/.github/workflows/build.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/build.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23
     permissions:
       contents: write
       pages: write
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ef5150..42fe377 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ permissions:
 jobs:
   ci:
     name: CI
-    uses: ApolloAutomation/Workflows/.github/workflows/esphome-ci.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/esphome-ci.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23
     with:
       yaml-files: |
         Integrations/ESPHome/AIR-1.yaml
diff --git a/.github/workflows/label-check.yml b/.github/workflows/label-check.yml
index 96a9751..9315e38 100644
--- a/.github/workflows/label-check.yml
+++ b/.github/workflows/label-check.yml
@@ -17,4 +17,4 @@ permissions:
 jobs:
   label-check:
     name: Label Check
-    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
index 9f8d09a..cd576ca 100644
--- a/.github/workflows/weekly.yml
+++ b/.github/workflows/weekly.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   build:
     name: Weekly Build
-    uses: ApolloAutomation/Workflows/.github/workflows/esphome-ci.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/esphome-ci.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23
     with:
       yaml-files: |
         Integrations/ESPHome/AIR-1.yaml