[pjhartlieb]

Adds dev-security.yml, which calls release-workflows dev-security.yml at v1.1.0 (pinned by commit SHA). On every pull request it runs dependency review and the workflow lint (actionlint, zizmor), the security checks publishing policy rule 3 requires on dev. Once this merges, the dev ruleset requires dev-security / dependency-review and dev-security / workflow-lint.

It also fixes what zizmor reports in the existing workflows, so the new check starts green:

• cla.yml: both triggers marked as reviewed. cla-reusable.yml never checks out pull request code.
• publish.yml: the same-repository workflow calls marked as reviewed.
• benchmark.yml (where present): checkouts no longer persist credentials.
• dependabot.yml: version updates wait 7 days after a release is published (cooldown), so a compromised release has time to be caught first. Security updates are not delayed.

Locally: actionlint 1.7.12 clean, zizmor 1.30.1 (the version the check runs) no findings across the repository.

[github-actions]

RadixTarget Benchmark Results

100000 networks per table, 100000 lookups, median of 5 runs (seed 1337).

Benchmark	dev (ms)	ci/dev-security (ms)	Change
IPv4 insert	35.37	35.84	+1.3%
IPv4 lookup	32.61	33.00	+1.2%
IPv6 insert	84.09	87.38	+3.9%
IPv6 lookup	68.79	69.43	+0.9%

Change is in time taken: negative is faster.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100%. Comparing base (bdc95d9) to head (7761206).
⚠️ Report is 54 commits behind head on dev.

Additional details and impacted files

@@         Coverage Diff         @@
##            dev   #127   +/-   ##
===================================
  Coverage   100%   100%           
===================================
  Files         3      3           
  Lines       605    605           
===================================
  Hits        605    605           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.