From 82ed9729ca36b40c2eae35ebd9ca3650fc13e2f0 Mon Sep 17 00:00:00 2001
From: Titus Kirch <titus.kirch@kirch.dev>
Date: Wed, 2 Sep 2026 14:22:54 +0200
Subject: [PATCH] fix(ci): pin the workflow bodies to v0.7.0

One pin across the estate. v0.7.0 hands the regenerate body the caller's own
token and lets its change check decide the assignee.
---
 .github/workflows/ci.yml                 | 2 +-
 .github/workflows/codeql.yml             | 2 +-
 .github/workflows/fast-forward-queue.yml | 2 +-
 .github/workflows/promotion-pr.yml       | 2 +-
 .github/workflows/queue-branch.yml       | 2 +-
 .github/workflows/release-please.yml     | 6 +++---
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aba28eb..930208f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,4 +23,4 @@ permissions:
 jobs:
   check:
     name: CI
-    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4d1b3ff..9ca3032 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,4 +20,4 @@ jobs:
       packages: read
       actions: read
       contents: read
-    uses: kirchDev/workflows/.github/workflows/_codeql.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_codeql.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
diff --git a/.github/workflows/fast-forward-queue.yml b/.github/workflows/fast-forward-queue.yml
index 5be1e16..ebeba96 100644
--- a/.github/workflows/fast-forward-queue.yml
+++ b/.github/workflows/fast-forward-queue.yml
@@ -25,7 +25,7 @@ jobs:
       pull-requests: read
       checks: read
       statuses: read
-    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
     with:
       pr: ${{ inputs.pr }}
     secrets:
diff --git a/.github/workflows/promotion-pr.yml b/.github/workflows/promotion-pr.yml
index 17203ed..3420f99 100644
--- a/.github/workflows/promotion-pr.yml
+++ b/.github/workflows/promotion-pr.yml
@@ -15,4 +15,4 @@ permissions:
 jobs:
   promotion-pr:
     name: Promotion PR
-    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
diff --git a/.github/workflows/queue-branch.yml b/.github/workflows/queue-branch.yml
index d8e674e..92e88a7 100644
--- a/.github/workflows/queue-branch.yml
+++ b/.github/workflows/queue-branch.yml
@@ -16,6 +16,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
     secrets:
       BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 34628b7..0284363 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_release-please.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_release-please.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
     with:
       # This package is consumed as `kirchDev/gitignore-sync@<ref>`, so `@v0`
       # has to keep meaning "the newest v0.x.y".
@@ -47,7 +47,7 @@ jobs:
     # `build-script` is left at its default: this repo's `build` writes the npm
     # artifact itself. coverage-report needs `build:npm` there only because its
     # `build` produces an Action bundle instead.
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
     with:
       tag-name: ${{ needs.release-please.outputs.tag-name }}
 
@@ -67,6 +67,6 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@b7bc3408448d1c0c1266e8c5fe2788c9cf120790 # v0.5.0
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@7fd4eaf529500fcd07c527ae70c839ab9ac7d76f # v0.7.0
     with:
       prerelease: true