From 55fc563c69fb5b6b700e52a46c5d2ad38f3d9cd8 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Mon, 2 Mar 2026 15:50:54 -1000
Subject: [PATCH] Checkout base branch to prevent PR author code injection

pull_request_review checks out the PR merge commit by default,
which means require() would load the PR author's version of
shared scripts. Explicitly checkout the base branch SHA instead.
---
 .github/workflows/codeowner-approved-label.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeowner-approved-label.yml b/.github/workflows/codeowner-approved-label.yml
index d81dad7f76..7ba9f126c2 100644
--- a/.github/workflows/codeowner-approved-label.yml
+++ b/.github/workflows/codeowner-approved-label.yml
@@ -21,8 +21,10 @@ jobs:
     if: ${{ github.repository == 'esphome/esphome' }}
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout base branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Check codeowner approval and update label
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0