From e1f4111f687206784d6dabca887cc5bf014309bc Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Wed, 21 Oct 2026 17:21:29 -0400 Subject: [PATCH 1/3] chore: pin CLA at the provenance check (CLA#12 31d7219), grant check pull-requests: read Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 5cd6b13..24c3c99 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -14,7 +14,8 @@ jobs: permissions: contents: read actions: read - uses: blacklanternsecurity/CLA/.github/workflows/release-check.yml@6fc2cf5fe9b8458452c494e8f3285d4aa250e076 # fix/release-on-stable (rehearsal) + pull-requests: read + uses: blacklanternsecurity/CLA/.github/workflows/release-check.yml@31d721990c676a274e4edbc55dfe841ddf6995b6 # fix/release-on-stable (rehearsal) tests: needs: check @@ -63,7 +64,7 @@ jobs: if: needs.check.outputs.release == 'true' permissions: contents: read - uses: blacklanternsecurity/CLA/.github/workflows/publish.yml@6fc2cf5fe9b8458452c494e8f3285d4aa250e076 # fix/release-on-stable (rehearsal) + uses: blacklanternsecurity/CLA/.github/workflows/publish.yml@31d721990c676a274e4edbc55dfe841ddf6995b6 # fix/release-on-stable (rehearsal) with: version: ${{ needs.check.outputs.version }} tag: ${{ needs.check.outputs.tag }} From 702b16fbda6c6d998b4658965db73c20dcbf9455 Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Wed, 21 Oct 2026 17:23:33 -0400 Subject: [PATCH 2/3] ci(dev-security): pin zizmor 1.15.2 and block on medium and above The action defaulted to the newest zizmor, whose new low-severity self-repository audit failed the gate on a style suggestion. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/dev-security.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml index 7d9a67c..283a19a 100644 --- a/.github/workflows/dev-security.yml +++ b/.github/workflows/dev-security.yml @@ -35,3 +35,8 @@ jobs: - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 with: advanced-security: false + # Pinned, so the gate's verdict changes only when we change it. The action defaults to the + # newest zizmor, which can add audits overnight. + version: "1.15.2" + # Block on real problems; low-severity findings are style and would train people to ignore the gate. + min-severity: medium From 0c312e39054dcdfa944c46b44615d80e0e1c65ca Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Thu, 29 Oct 2026 14:05:55 -0400 Subject: [PATCH 3/3] Pin release-workflows v1.0.0 and map the release key Moves release-check.yml and publish.yml from the CLA rehearsal branch to release-workflows v1.0.0, and passes BLS_RELEASE_PRIVATE_KEY by name: a reusable workflow's environment job gets the environment secret only when the caller maps it. --- .github/workflows/publish.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 24c3c99..1a13821 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -15,7 +15,9 @@ jobs: contents: read actions: read pull-requests: read - uses: blacklanternsecurity/CLA/.github/workflows/release-check.yml@31d721990c676a274e4edbc55dfe841ddf6995b6 # fix/release-on-stable (rehearsal) + uses: blacklanternsecurity/release-workflows/.github/workflows/release-check.yml@c53c202eedeb26a86088936363e6cb06ce99ac15 # v1.0.0 + secrets: + BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }} tests: needs: check @@ -64,9 +66,11 @@ jobs: if: needs.check.outputs.release == 'true' permissions: contents: read - uses: blacklanternsecurity/CLA/.github/workflows/publish.yml@31d721990c676a274e4edbc55dfe841ddf6995b6 # fix/release-on-stable (rehearsal) + uses: blacklanternsecurity/release-workflows/.github/workflows/publish.yml@c53c202eedeb26a86088936363e6cb06ce99ac15 # v1.0.0 with: version: ${{ needs.check.outputs.version }} tag: ${{ needs.check.outputs.tag }} artifacts: dist assets: dist/* + secrets: + BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }}