From d624bd045837ed74b31e1eddb75f2fc9a54ca5a7 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <pkarwasz-github@apache.org>
Date: Sat, 25 Jul 2026 13:14:51 +0200
Subject: [PATCH] Pin reactivecircus/android-emulator-runner

Replace the wildcard with the v2.38.0 SHA as the permanent,
Dependabot-maintained pin. The v2.37.0 and v2.34.0 SHAs and the
floating v2 tag (still used by 14 apache repos) are whitelisted
until 2026-08-25 to give those repos time to migrate.

Generated-by: Claude Fable 5 (Claude Code)
---
 .../for-dependabot-triggered-reviews/action.yml     |  2 ++
 actions.yml                                         | 13 +++++++++++--
 approved_patterns.yml                               |  5 ++++-
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/actions/for-dependabot-triggered-reviews/action.yml b/.github/actions/for-dependabot-triggered-reviews/action.yml
index 8d6d048d..3586ae9f 100644
--- a/.github/actions/for-dependabot-triggered-reviews/action.yml
+++ b/.github/actions/for-dependabot-triggered-reviews/action.yml
@@ -225,6 +225,8 @@ runs:
       if: false
     - uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266  # v1.1.0
       if: false
+    - uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d  # v2.38.0
+      if: false
     - uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a  # v2.1.0
       if: false
     - uses: rubygems/release-gem@052cc82692552de3ef2b81fd670e41d13cba8092  # v1.4.0
diff --git a/actions.yml b/actions.yml
index 35134578..832e355f 100644
--- a/actions.yml
+++ b/actions.yml
@@ -855,8 +855,17 @@ r-lib/actions/*:
   '*':
     keep: true
 reactivecircus/android-emulator-runner:
-  '*':
-    keep: true
+  a421e43855164a8197daf9d8d40fe71c6996bb0d:
+    tag: v2.38.0
+  e89f39f1abbbd05b1113a29cf4db69e7540cae5a:
+    tag: v2.37.0
+    expires_at: 2026-08-25
+  1dcd0090116d15e7c562f8db72807de5e036a4ed:
+    tag: v2.34.0
+    expires_at: 2026-08-25
+  # Transitional: 11 apache repos still use the floating v2 tag.
+  v2:
+    expires_at: 2026-08-25
 readthedocs/actions:
   '*':
     keep: true
diff --git a/approved_patterns.yml b/approved_patterns.yml
index 84019d1c..36fe7e27 100644
--- a/approved_patterns.yml
+++ b/approved_patterns.yml
@@ -294,7 +294,10 @@
 - quarto-dev/quarto-actions@*
 - quarto-dev/quarto-actions/*@*
 - r-lib/actions/*@*
-- reactivecircus/android-emulator-runner@*
+- reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d
+- reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a
+- reactivecircus/android-emulator-runner@1dcd0090116d15e7c562f8db72807de5e036a4ed
+- reactivecircus/android-emulator-runner@v2
 - readthedocs/actions@*
 - readthedocs/actions/preview@*
 - release-drafter/release-drafter@*