From addfa24d837b587a5ef646d3819360632f221629 Mon Sep 17 00:00:00 2001
From: Brandon Harvey <8107750+bharvey88@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:53:35 -0500
Subject: [PATCH 1/2] Enable API encryption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add an empty encryption: key to the api: block so ESPHome/HA
provisions a per-device API key on adoption, matching MSR-1. Bump
firmware version to 26.7.14.1.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 Integrations/ESPHome/Core.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Integrations/ESPHome/Core.yaml b/Integrations/ESPHome/Core.yaml
index 64bcb20..13f8313 100644
--- a/Integrations/ESPHome/Core.yaml
+++ b/Integrations/ESPHome/Core.yaml
@@ -1,6 +1,6 @@
 substitutions:
   name: apollo-msr-2
-  version: "26.7.12.1"
+  version: "26.7.14.1"
   device_description: ${name} made by Apollo Automation - version ${version}.
   # Default update channel on first boot (no stored user choice yet, i.e. a
   # fresh flash). The beta-channel builds override this to "Beta" (see
@@ -104,6 +104,7 @@ globals:
 # Enable Home Assistant API
 # Also Add Buzzer Action Connection
 api:
+  encryption:
   actions:
     - action: play_buzzer
       variables:

From 09399b5e87ff1cb4008fdf19a769c532c0b2f2d6 Mon Sep 17 00:00:00 2001
From: Brandon Harvey <8107750+bharvey88@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:14:53 -0500
Subject: [PATCH 2/2] Remove duplicate label-check job from CI workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The label-check job in ci.yml duplicates label-check.yml and, because
ci.yml runs on plain pull_request, always fails on fork-submitted PRs
where the token is read-only and cannot apply labels. label-check.yml
already handles this on pull_request_target. Drop the redundant job and
the now-unneeded pull-requests/issues write permissions, matching the
already-clean main on MSR-1 and CAST-1.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 .github/workflows/ci.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66cac36..1faefd3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,15 +4,11 @@ on:
   pull_request:
 
 permissions:
-  pull-requests: write
-  issues: write
   contents: read
 
+# Label check lives in label-check.yml on pull_request_target so it can
+# label fork-submitted PRs; plain pull_request tokens are read-only there.
 jobs:
-  label-check:
-    name: Label Check
-    uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main
-
   ci:
     name: CI
     uses: ApolloAutomation/Workflows/.github/workflows/esphome-ci.yml@main