GitHub Actions SHA Pinning Compliance

This issue tracks SHA pinning compliance for GitHub Actions across all repositories in the [esphome](https://github.com/esphome) organization.

**SHA pinning** means referencing actions by their full commit SHA (e.g., `actions/checkout@`) instead of a mutable tag (e.g., `actions/checkout@v4`). This prevents supply-chain attacks via compromised or force-pushed tags.

The **Enforced** column shows whether the repo has `sha_pinning_required` enabled in Settings > Actions > General.

Each non-compliant repository has a linked sub-issue with details.

### Summary

- **46** fully pinned
- **3** not fully pinned
- **0** with workflows but no external actions
- **9** without workflows
- **58** enforced / **0** not enforced

### Fully SHA-Pinned Repositories

| Repository | Enforced | Workflow Files |
|---------------------------------------------------------------------------------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [AsyncTCP](https://github.com/esphome/AsyncTCP) | Yes | `publish.yml`, `push.yml` |
| [ESPAsyncTCP](https://github.com/esphome/ESPAsyncTCP) | Yes | `push.yml` |
| [ESPAsyncWebServer](https://github.com/esphome/ESPAsyncWebServer) | Yes | `publish.yml`, `push.yml`, `release-drafter.yml` |
| [aioesphomeapi](https://github.com/esphome/aioesphomeapi) | Yes | `bump-esphome.yml`, `ci.yml`, `close-pr-from-fork-default-branch.yml`, `docker.yml`, `labeler.yml`, `lock.yml`, `release-drafter.yml`, `release.yml` |
| [bluetooth-proxies](https://github.com/esphome/bluetooth-proxies) | Yes | `build.yml`, `lock.yml`, `publish.yml`, `release-drafter.yml`, `release.yml`, `stale.yml`, `yaml-lint.yml` |
| [build-action](https://github.com/esphome/build-action) | Yes | `ci.yml`, `release-drafter.yml`, `action.yml` |
| [component-image-generator](https://github.com/esphome/component-image-generator) | Yes | `build.yml`, `action.yml` |
| [dashboard-api](https://github.com/esphome/dashboard-api) | Yes | `pythonpublish.yml`, `release-drafter.yml` |
| [data.esphome.io](https://github.com/esphome/data.esphome.io) | Yes | `publish.yml`, `automations/action.yml`, `component-changes/action.yml`, `components/action.yml` |
| [deployments](https://github.com/esphome/deployments) | Yes | `lint.yml` |
| [developers.esphome.io](https://github.com/esphome/developers.esphome.io) | Yes | `ci.yml`, `lock.yml` |
| [device-builder](https://github.com/esphome/device-builder) | Yes | `auto-release.yml`, `bump-esphome-docker-pin.yml`, `check-board-images.yml`, `close-uneditable-fork-pr.yml`, `device-status-followup.yml`, `draft-next-releases.yml`, `lock.yml`, `pages-ci.yml`, `pages.yml`, `pr-labels.yaml`, `real-compile-tests.yml`, `regen-board-catalog.yml`, `release.yml`, `sync-component-catalog.yml`, `sync-device-catalog.yml`, `sync-on-esphome-release.yml`, `test.yml`, `windows-real-compile.yml`, `.github/actions/generate-release-notes/action.yml`, `.github/actions/resolve-release-versions/action.yml`, `.github/actions/restore-or-build-venv/action.yml`, `.github/actions/setup-uv-python/action.yml` |
| [device-builder-frontend](https://github.com/esphome/device-builder-frontend) | Yes | `auto-approve-dependabot.yml`, `auto-release.yml`, `deploy-web.yml`, `lock.yml`, `pr-labels.yaml`, `release.yml`, `test.yml`, `translations-upload.yml`, `yamllint.yml` |
| [devices.esphome.io](https://github.com/esphome/devices.esphome.io) | Yes | `ci.yaml`, `commit-date-published.yml`, `label-pr-type.yml`, `made-for-esphome-review-command.yml`, `made-for-esphome-review-feedback.yml`, `made-for-esphome-review.yml`, `made-for-esphome.yml`, `pr-validation-feedback.yml`, `update-date-published.yml`, `weekly-link-check.yml` |
| [docker-base](https://github.com/esphome/docker-base) | Yes | `build.yml`, `renovate.yml` |
| [esp-hosted-firmware](https://github.com/esphome/esp-hosted-firmware) | Yes | `build.yml`, `check-update.yml` |
| [esp-stacktrace-decoder](https://github.com/esphome/esp-stacktrace-decoder) | Yes | `release-drafter.yml`, `release.yml` |
| [esp-web-tools](https://github.com/esphome/esp-web-tools) | Yes | `ci.yml`, `npmpublish.yml`, `pages.yml`, `release-drafter.yml` |
| [esphome](https://github.com/esphome/esphome) | Yes | `auto-label-pr.yml`, `ci-api-proto.yml`, `ci-docker.yml`, `ci-github-scripts.yml`, `ci-memory-impact-comment.yml`, `ci.yml`, `close-pr-from-fork-default-branch.yml`, `codeowner-approved-label-update.yml`, `codeowner-review-request.yml`, `codeql.yml`, `external-component-bot.yml`, `issue-codeowner-notify.yml`, `lock.yml`, `pr-title-check.yml`, `release-nightly.yml`, `release.yml`, `stale.yml`, `status-check-labels.yml`, `sync-device-classes.yml`, `.github/actions/build-image/action.yaml`, `.github/actions/cache-esp-idf/action.yml`, `.github/actions/cache-sdk-nrf/action.yml`, `.github/actions/restore-python/action.yml` |
| [esphome-desktop](https://github.com/esphome/esphome-desktop) | Yes | `build.yml`, `bump-bundle-versions.yml`, `bump-docs-fallback-version.yml`, `cancel-superseded-builds.yml`, `deploy-pages.yml`, `lint-test.yml`, `lock.yml`, `pr-comment.yml`, `publish-aur.yml`, `python-tree-repair.yml`, `release-drafter.yml`, `scripts-test.yml`, `translations-upload.yml`, `.github/actions/linux-tauri-deps/action.yml`, `.github/actions/setup-rust/action.yml`, `.github/actions/stub-bundle-dirs/action.yml` |
| [esphome-glyphsets](https://github.com/esphome/esphome-glyphsets) | Yes | `ci.yml`, `issue-manager.yml`, `upgrader.yml` |
| [esphome-project-template](https://github.com/esphome/esphome-project-template) | Yes | `build.yml`, `publish-pages.yml`, `release-drafter.yml`, `release.yml`, `repository-generated.yml`, `yaml-lint.yml` |
| [esphome-schema](https://github.com/esphome/esphome-schema) | Yes | `generate-schemas.yml` |
| [esphome-webserver](https://github.com/esphome/esphome-webserver) | Yes | `build.yaml`, `ci.yaml`, `release.yaml` |
| [esphome.io](https://github.com/esphome/esphome.io) | Yes | `auto-label-pr.yml`, `check-component-index.yml`, `ci.yml`, `close-pr-from-fork-default-branch.yml`, `component-image.yml`, `imgbot-auto-merge.yml`, `labeller-recheck.yml`, `lock.yml`, `seed-npm-cache.yml`, `stale.yml` |
| [ewt-gen](https://github.com/esphome/ewt-gen) | Yes | `publish.yml`, `website.yml` |
| [feature-requests](https://github.com/esphome/feature-requests) | Yes | `auto-labeller.yml`, `close-bypassed-discussions.yml`, `close-issues.yml`, `lock.yml` |
| [firmware](https://github.com/esphome/firmware) | Yes | `build.yml`, `check-generated-configs.yml`, `lock.yml`, `stale.yml`, `yaml-lint.yml` |
| [home-assistant-addon](https://github.com/esphome/home-assistant-addon) | Yes | `bump-version.yml`, `devcontainer-build.yaml`, `lint.yml` |
| [home-assistant-voice-pe](https://github.com/esphome/home-assistant-voice-pe) | Yes | `build.yml`, `gh-pages.yml`, `update-latest.yml`, `yaml-lint.yml` |
| [infrared-proxies](https://github.com/esphome/infrared-proxies) | Yes | `build.yml`, `lock.yml`, `publish.yml`, `release-drafter.yml`, `release.yml`, `stale.yml`, `yaml-lint.yml` |
| [issues](https://github.com/esphome/issues) | Yes | `lock.yml`, `stale.yml` |
| [media-players](https://github.com/esphome/media-players) | Yes | `build.yml`, `lock.yml`, `stale.yml`, `yaml-lint.yml` |
| [media.esphome.io](https://github.com/esphome/media.esphome.io) | Yes | `deploy.yml` |
| [pre-commit-action](https://github.com/esphome/pre-commit-action) | Yes | `main.yml`, `action.yml` |
| [ready-made-project-template](https://github.com/esphome/ready-made-project-template) | Yes | `bootstrap.yml`, `build.yml`, `lock.yml`, `publish.yml`, `release-drafter.yml`, `release.yml`, `stale.yml`, `yaml-lint.yml` |
| [rf-proxies](https://github.com/esphome/rf-proxies) | Yes | `build.yml`, `lock.yml`, `publish.yml`, `release-drafter.yml`, `release.yml`, `stale.yml`, `yaml-lint.yml` |
| [roadmap](https://github.com/esphome/roadmap) | Yes | `restrict-issue-creation.yml` |
| [serial-proxies](https://github.com/esphome/serial-proxies) | Yes | `build.yml`, `lock.yml`, `publish.yml`, `release-drafter.yml`, `release.yml`, `stale.yml`, `yaml-lint.yml` |
| [starter-components](https://github.com/esphome/starter-components) | Yes | `ci.yml`, `yaml-lint.yml` |
| [version-notifier](https://github.com/esphome/version-notifier) | Yes | `notify.yml`, `track-bump-prs.yml`, `trigger-device-builder.yml`, `trigger-ha-addon.yml`, `trigger-schema.yml`, `update-firmware-repos.yml` |
| [voice-kit-xmos-firmware](https://github.com/esphome/voice-kit-xmos-firmware) | Yes | `apps.yml`, `ci.yml`, `docker.yml` |
| [wake-word-voice-assistants](https://github.com/esphome/wake-word-voice-assistants) | Yes | `build-minimal.yml`, `build.yml`, `lock.yml`, `stale.yml`, `yaml-lint.yml` |
| [workflow-shas](https://github.com/esphome/workflow-shas) | Yes | `check.yml`, `action.yml` |
| [workflows](https://github.com/esphome/workflows) | Yes | `build-to-draft-release.yml`, `build.yml`, `ci-draft-release.yml`, `ci.yml`, `draft-calver-release.yml`, `lock.yml`, `promote-r2.yml`, `publish-draft-release.yml`, `publish-firmware-to-r2.yml`, `stale.yml`, `upload-to-gh-release.yml`, `upload-to-r2.yml` |
| [zwa-2](https://github.com/esphome/zwa-2) | Yes | `build.yml`, `lock.yml`, `stale.yml`, `yaml-lint.yml` |

### Repositories NOT Fully SHA-Pinned

| Repository | Enforced | Unpinned | Pinned |
|-------------------------------------------------------------------------------------------|----------|----------|--------|
| [home-assistant-voice-pe-alpha](https://github.com/esphome/home-assistant-voice-pe-alpha) | Yes | 11 | 0 |
| [xmos_fwk_io](https://github.com/esphome/xmos_fwk_io) | Yes | 7 | 0 |
| [xmos_fwk_rtos](https://github.com/esphome/xmos_fwk_rtos) | Yes | 2 | 0 |

### Repositories Without Workflows

- [.github](https://github.com/esphome/.github)
- [ESP32-audioI2S](https://github.com/esphome/ESP32-audioI2S)
- [ESPhome-GUI-Documentation](https://github.com/esphome/ESPhome-GUI-Documentation)
- [backlog](https://github.com/esphome/backlog)
- [esphome-learning-kit](https://github.com/esphome/esphome-learning-kit)
- [esphome-release](https://github.com/esphome/esphome-release)
- [esphome-vscode](https://github.com/esphome/esphome-vscode)
- [micro-wake-word-models](https://github.com/esphome/micro-wake-word-models)
- [pngle](https://github.com/esphome/pngle)

---
*This issue is automatically updated by a daily workflow.*