[singlerider]

What changed

• Publishing removed from rust-tests.yml and python-tests.yml, which used to publish on every stable push with long-lived tokens. Neither triggers on push: stable any more, so they no longer duplicate the calls from publish.yml.
• python-tests.yml and rust-tests.yml call CLA's shared workflows. The Python matrix comes from requires-python. ruff format --check now runs, and the extension is built with maturin develop. Rust runs --all-features --locked on the rust-toolchain.toml channel. CODECOV_TOKEN is passed by name. Until the default branch ruleset requires python / passed, a required job reports test (3.11) to (3.15) from the real result.
• publish.yml runs on a push to stable: CLA's release-check.yml, then rust and python tests, then CLA's maturin-wheels.yml (every interpreter requires-python allows, on Windows and macOS too), then PyPI with OIDC in release, then crates.io through CLA's crates.yml with trusted publishing, then CLA's publish.yml (tag and GitHub Release with SBOM and wheels, created last). No caller passes App credentials.
• stable-guard.yml: release ready on pull requests into stable refuses a non-MAJOR.MINOR.PATCH version and git or URL dependencies.
• cla.yml passes APP_ID/APP_PRIVATE_KEY by name. No workflow uses secrets: inherit. benchmark.yml declares contents: read and pull-requests: write and pins its runner.
• Cargo.toml is the single version source, now 4.3.1: 4.3.0 is on PyPI and crates.io with no v4.3.0 tag.
• Dead poetry.lock and .flake8 removed. Merges current dev (dependabot grouping, shared auto-merge).
• Every CLA reference is pinned to CLA#11 at 07e14bcbba5e737e1b29bd9e3f9128fbf2483be9. Re-pin to its merge commit before this merges.

Before promoting to stable

• release environment with reviewers and a stable-only deployment policy, holding BLS_RELEASE_APP_ID and BLS_RELEASE_PRIVATE_KEY.
• Trusted publishers on PyPI and crates.io for publish.yml, environment release. Then delete the PyPI and crates.io token secrets.
• Ruleset protecc (11169658), and the matching .github-config#1/Prune / Defragment branches to save space #2 Terraform: require python / passed, rust / passed and release ready, then drop the required job.

Validation

$ cargo test --all-features --locked
86 passed
$ cargo metadata --locked --no-deps
(lock consistent at 4.3.1)
$ uvx --from actionlint-py actionlint
(no findings)

Related issues

• Part of blacklanternsecurity/bbot-enterprise#139
• Part of blacklanternsecurity/bbot-enterprise#140
• Part of blacklanternsecurity/bbot-enterprise#149
• Part of blacklanternsecurity/bbot-enterprise#155
• Part of blacklanternsecurity/bbot-enterprise#156

Supersedes #96, moved from a fork to an upstream branch.

[github-actions]

RadixTarget Benchmark Results

100000 networks per table, 100000 lookups, median of 5 runs (seed 1337).

Benchmark	dev (ms)	ci/publish-on-tag (ms)	Change
IPv4 insert	21.44	21.94	+2.3%
IPv4 lookup	18.43	19.79	+7.4%
IPv6 insert	49.07	51.82	+5.6%
IPv6 lookup	42.23	46.89	🔴 +11.0%

Change is in time taken: negative is faster.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100%. Comparing base (9fc51ef) to head (83aec27).
⚠️ Report is 37 commits behind head on dev.

Additional details and impacted files

@@         Coverage Diff         @@
##            dev   #110   +/-   ##
===================================
  Coverage   100%   100%           
===================================
  Files         3      3           
  Lines       604    605    +1     
===================================
+ Hits        604    605    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[en0f]

Approved, FYI:

.github/workflows/cla.yml: the CLA check will fail to start once this reaches stable.

The file’s top-level permissions are only pull-requests: write and statuses: write. When you list any permissions, everything you leave out is set to none, so contents becomes none.
At the pinned commit 07e14bc, the shared cla-reusable.yml job asks for contents: read.
A called workflow can’t ask for more than its caller gives it. GitHub rejects the run before it starts with “nested job ‘CLAAssistant’ is requesting ‘contents: read’, but is only allowed ‘contents: none’”. This happens on every pull_request_target and issue_comment event, so no PR gets a CLA status.
The PR checks don’t show this. pull_request_target runs the default branch’s workflow, and the “CLA Assistant” check on this PR came from the old cla.yml already on stable.
CLAAssistant isn’t a required check in the protecc ruleset, so merges won’t be blocked. The CLA gate would just stop running without any error on the PR.
Fix: add contents: read to the permissions in cla.yml.

[en0f]

Approved, see comment:

Still broke: head is still 3510c97,

.github/workflows/cla.yml: the CLA check won’t start once this reaches stable.

The caller grants only pull-requests: write and statuses: write, so contents falls to none.
At the pinned commit 07e14bc, the CLAAssistant job in cla-reusable.yml asks for contents: read. GitHub refuses to start the run, so no PR gets a CLA status.
The green “CLA Assistant” check on this PR comes from the old cla.yml on the default branch. That’s how pull_request_target works, so the PR checks can’t catch this.
The fix is to add contents: read to cla.yml.
It won’t block merges, because protecc only requires test (3.11) through test (3.15).

[pjhartlieb]

release-workflows v1.0.0 is released. To move this PR onto it:

1. Replace every blacklanternsecurity/CLA/.github/workflows/<file>@07e14bcb… (8 calls in cla.yml, publish.yml, python-tests.yml, rust-tests.yml, stable-guard.yml) with:

   uses: blacklanternsecurity/release-workflows/.github/workflows/<file>@c53c202eedeb26a86088936363e6cb06ce99ac15 # v1.0.0

2. Map the release key on check (release-check.yml) and release (publish.yml). A reusable workflow gets the release environment's secret only when the caller passes it (README):

   secrets:
     BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }}

3. Rebase onto dev: the branch has conflicts.

Inputs, secrets and permissions otherwise match v1.0.0. Please hold the merge until this repo's release environment, trusted publishers and tag rulesets are in place and the sandbox pilot has released.

[en0f]

@pjhartlieb -
I found one blocker. It won’t stop this PR merging into dev, but it will make the first release fail when dev is promoted to stable.

Blocker: the first release from publish.yml will fail the provenance check.

Where it fails: release-check.yml at v1.0.0 runs provenance.py. That script walks the first-parent history of stable back to the last v* tag and requires every commit since then to belong to a PR merged into stable.

Why: The only v* tag reachable from stable is v3.0.0 (4.3.0 shipped without a tag). That leaves 34 first-parent commits to check, and I looked each one up with the GitHub API. 30 of them don’t pass:
5 direct pushes with no PR: the CLA commits cbd63aa, ff0ac17, e2787a1, ab32e6a and 0ecc48e.
25 merges of PRs whose base is master, not stable: #20–#27, #43–#51, #60, #62, #63 and #65–#69, all from before the branch rename. merged_into() checks the base name exactly.

What happens: The check job exits with “30 commit(s) since v3.0.0 bypassed review”. The tests, wheels, PyPI, crates.io and release jobs never run.

Fix: Before promoting, push a v4.3.0 tag on 3317d3e, the merge of #105 that shipped 4.3.0. The check would then start from there and only see #108 and #111 (both fine) plus the promotion merge. That also fills the tag gap the PR description mentions.