From 88309ac2bded7168fae3881d998fe0da45832b27 Mon Sep 17 00:00:00 2001
From: Brandon Harvey <8107750+bharvey88@users.noreply.github.com>
Date: Fri, 24 Jul 2026 11:01:56 -0500
Subject: [PATCH] ci: pin label-check reusable workflow to a commit SHA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

label-check.yml referenced ApolloAutomation/Workflows via the mutable
@main ref, so a change in the Workflows repo could silently alter what
runs here. Pin it to the current reviewed commit SHA, matching how the
repo already pins third-party actions. build.yml is pinned separately
on the unified/firmware-channel branch (PR #70).

Ports the fix from AIR-1 #118 to PLT-1.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 .github/workflows/label-check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/label-check.yml b/.github/workflows/label-check.yml
index 96a9751..9315e38 100644
--- a/.github/workflows/label-check.yml
+++ b/.github/workflows/label-check.yml
@@ -17,4 +17,4 @@ permissions:
 jobs:
   label-check:
     name: Label Check
-    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23