From dce1c388bbd53d77f03cc8d634a760188ea19bdd Mon Sep 17 00:00:00 2001
From: Brandon Harvey <8107750+bharvey88@users.noreply.github.com>
Date: Fri, 24 Jul 2026 11:02:45 -0500
Subject: [PATCH] Pin shared reusable workflows to a commit SHA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pins the two ApolloAutomation/Workflows reusable workflow references (build,
label-check) from the mutable @main ref to the current reviewed commit SHA,
matching how the repo already pins third-party actions. A change to the
Workflows repo would otherwise silently change what runs here.

MTR-1's ci.yml, autoassign.yml, and weekly.yml are inline and do not
reference the shared Workflows repo, so only these two files change.

Trade-off: future Workflows updates need a pin bump in this repo.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 .github/workflows/build.yml       | 2 +-
 .github/workflows/label-check.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 379472a..ff21923 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,7 +16,7 @@ on:
 
 jobs:
   build-and-publish:
-    uses: ApolloAutomation/Workflows/.github/workflows/build.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/build.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23
     permissions:
       contents: write
       pages: write
diff --git a/.github/workflows/label-check.yml b/.github/workflows/label-check.yml
index 96a9751..9315e38 100644
--- a/.github/workflows/label-check.yml
+++ b/.github/workflows/label-check.yml
@@ -17,4 +17,4 @@ permissions:
 jobs:
   label-check:
     name: Label Check
-    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main
+    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@430d90dc695c6f7d1075c4e4a0df4b13a6496252 # main 2026-07-23