From 09399b5e87ff1cb4008fdf19a769c532c0b2f2d6 Mon Sep 17 00:00:00 2001
From: Brandon Harvey <8107750+bharvey88@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:14:53 -0500
Subject: [PATCH] Remove duplicate label-check job from CI workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The label-check job in ci.yml duplicates label-check.yml and, because
ci.yml runs on plain pull_request, always fails on fork-submitted PRs
where the token is read-only and cannot apply labels. label-check.yml
already handles this on pull_request_target. Drop the redundant job and
the now-unneeded pull-requests/issues write permissions, matching the
already-clean main on MSR-1 and CAST-1.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 .github/workflows/ci.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66cac36..1faefd3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,15 +4,11 @@ on:
   pull_request:
 
 permissions:
-  pull-requests: write
-  issues: write
   contents: read
 
+# Label check lives in label-check.yml on pull_request_target so it can
+# label fork-submitted PRs; plain pull_request tokens are read-only there.
 jobs:
-  label-check:
-    name: Label Check
-    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main
-
   ci:
     name: CI
     uses: ApolloAutomation/Workflows/.github/workflows/esphome-ci.yml@main