Merge branch 'main' into fix_pre_commit_config_2

.github/CODEOWNERS

@@ -1,2 +1,2 @@
 # All PRs to V1 must be approved by Frooodle
-* @Frooodle
+* @Frooodle @reecebrowne @Ludy87 @DarioGii

.github/workflows/auto-labeler.yml

@@ -5,12 +5,10 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   labeler:
-    permissions:
-      contents: read
-      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/check_properties.yml

@@ -14,6 +14,8 @@ jobs:
   check-files:
     if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
@@ -31,7 +33,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: "${{ github.event.pull_request.merge_commit_sha }}"
           path: pr-branch
           fetch-depth: 0