From 50e64f64a81f2a8fc684d289c7194ce44aac9735 Mon Sep 17 00:00:00 2001
From: Philip Hartlieb <philip@blacklanternsecurity.com>
Date: Mon, 9 Nov 2026 10:47:27 -0500
Subject: [PATCH 1/2] Run dependency review and workflow lint on pull requests

Calls release-workflows dev-security.yml (v1.1.0), the security checks policy rule 3 requires on dev. Fixes what zizmor reports: the CLA triggers are marked as reviewed (cla-reusable.yml never checks out pull request code), benchmark checkouts drop persisted credentials, and publish.yml's local workflow calls are marked as reviewed (same-repository calls on stable).
---
 .github/workflows/benchmark.yml    |  2 ++
 .github/workflows/cla.yml          |  5 +++--
 .github/workflows/dev-security.yml | 11 +++++++++++
 .github/workflows/publish.yml      |  4 ++--
 4 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/dev-security.yml

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 3880f8b..f151758 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -18,11 +18,13 @@ jobs:
       - name: Check out PR
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           path: head
 
       - name: Check out target branch
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.base.sha }}
           path: base
 
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index e30d6f9..edcd49f 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -1,9 +1,10 @@
 name: CLA
 
+# The CLA bot needs both triggers; cla-reusable.yml never checks out pull request code.
 on:
-  issue_comment:
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, closed, synchronize]
 
 permissions:
diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml
new file mode 100644
index 0000000..b674f80
--- /dev/null
+++ b/.github/workflows/dev-security.yml
@@ -0,0 +1,11 @@
+name: dev-security
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@12139195c6f35d8b4478bb8ec3df94aa275da01e # v1.1.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e008f1f..a04ee42 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,14 +25,14 @@ jobs:
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/rust-tests.yml
+    uses: ./.github/workflows/rust-tests.yml # zizmor: ignore[self-repository]
 
   python:
     needs: check
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/python-tests.yml
+    uses: ./.github/workflows/python-tests.yml # zizmor: ignore[self-repository]
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 

From 7761206dad15cdb8556541cb806b7486c4a15fff Mon Sep 17 00:00:00 2001
From: Philip Hartlieb <philip@blacklanternsecurity.com>
Date: Mon, 9 Nov 2026 10:57:22 -0500
Subject: [PATCH 2/2] Wait 7 days before Dependabot proposes a new release

zizmor dependabot-cooldown (the workflow-lint check on this PR): version updates now wait 7 days after a release is published, so a compromised release has time to be caught and pulled before it is proposed here. Security updates are not delayed.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f2a13f9..3c88e4c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -19,6 +19,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "uv"
     directory: "/"
     target-branch: "dev"
@@ -36,6 +38,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     target-branch: "dev"
@@ -53,3 +57,5 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7