From 74ceb82582e0eda88a4ae76f33204bf98d97ffed Mon Sep 17 00:00:00 2001 From: Brandon Harvey <8107750+bharvey88@users.noreply.github.com> Date: Fri, 24 Jul 2026 11:00:41 -0500 Subject: [PATCH] Pin label-check reusable workflow to a commit SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pins the ApolloAutomation/Workflows label-check reference from the mutable @main ref to commit 430d90dc (main 2026-07-23), matching how the repo already pins third-party actions. label-check runs on pull_request_target with a write token, so a change to the Workflows repo silently changes what runs privileged here. The build.yml ref is pinned separately in PR #46. Trade-off: future Workflows updates need a pin bump in this repo. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- .github/workflows/label-check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/label-check.yml b/.github/workflows/label-check.yml index 96a9751..9315e38 100644 --- a/.github/workflows/label-check.yml +++ b/.github/workflows/label-check.yml @@ -17,4 +17,4 @@ permissions: jobs: label-check: name: Label Check - uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main + uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23