11.2.0 Release

.github/dependabot.yml

@@ -1,21 +1,87 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
 version: 2
 updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+    groups:
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      cargo-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
   - package-ecosystem: "uv"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"
+    groups:
+      uv-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      uv-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "github-actions"
+    directory: "/"
     target-branch: "dev"
-    open-pull-requests-limit: 10
-  - package-ecosystem: github-actions
-    directory: /
+    schedule:
+      interval: "weekly"
     groups:
-      github-actions:
+      github-actions-minor-patch:
         patterns:
-          - "*"  # Group all Actions updates into a single larger pull request
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      github-actions-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "docker"
+    directory: "/"
+    target-branch: "dev"
     schedule:
-      interval: weekly
+      interval: "weekly"
+    groups:
+      docker-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      docker-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "helm"
+    directory: "/helm"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+    groups:
+      helm-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      helm-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"

.github/workflows/cla.yml

@@ -1,4 +1,5 @@
-name: "CLA Assistant"
+name: CLA
+
 on:
   issue_comment:
     types: [created]
@@ -10,88 +11,6 @@ permissions:
   statuses: write
 
 jobs:
-  CLAAssistant:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate token from GitHub App
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          owner: blacklanternsecurity
-
-      - name: Check all committers against org and allowlist
-        id: cla-check
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request_target" ]; then
-            PR_NUM="${{ github.event.pull_request.number }}"
-          else
-            PR_NUM="${{ github.event.issue.number }}"
-          fi
-
-          COMMITTERS=$(gh api "repos/${{ github.repository }}/pulls/$PR_NUM/commits" --paginate --jq '.[].author.login' | sort -u)
-          ALL_EXEMPT=true
-
-          for LOGIN in $COMMITTERS; do
-            # treat commits with no associated GitHub login as non-exempt
-            if [ -z "$LOGIN" ] || [ "$LOGIN" = "null" ]; then
-              echo "Unknown committer (no GitHub login) — not exempt"
-              ALL_EXEMPT=false
-              break
-            fi
-
-            EXEMPT=false
-
-            # check if account type is Bot (GitHub App accounts)
-            AUTHOR_TYPE=$(gh api "users/${LOGIN}" --jq '.type' 2>/dev/null || echo "Unknown")
-            if [ "$AUTHOR_TYPE" = "Bot" ]; then
-              echo "$LOGIN is a Bot account — exempt"
-              EXEMPT=true
-            fi
-
-            # check org membership
-            if [ "$EXEMPT" = "false" ]; then
-              if gh api "orgs/blacklanternsecurity/members/$LOGIN" > /dev/null 2>&1; then
-                echo "$LOGIN is an org member — exempt"
-                EXEMPT=true
-              fi
-            fi
-
-            if [ "$EXEMPT" = "false" ]; then
-              echo "$LOGIN is not exempt — CLA required"
-              ALL_EXEMPT=false
-              break
-            fi
-          done
-
-          echo "all_exempt=$ALL_EXEMPT" >> "$GITHUB_OUTPUT"
-
-      - name: Skip CLA when all committers are exempt
-        if: steps.cla-check.outputs.all_exempt == 'true' && github.event_name == 'pull_request_target'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api --method POST "repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }}" \
-            -f state=success \
-            -f context="CLAAssistant" \
-            -f description="CLA check skipped — all committers are org members or bots"
-
-      - name: "CLA Assistant"
-        if: |
-          (steps.cla-check.outputs.all_exempt != 'true') &&
-          ((github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target')
-        uses: contributor-assistant/github-action@v2.6.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PERSONAL_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
-        with:
-          path-to-signatures: "signatures/version1/cla.json"
-          path-to-document: "https://github.com/blacklanternsecurity/CLA/blob/main/ICLA.md"
-          branch: "main"
-          allowlist: "dependabot[bot],github-actions[bot],renovate[bot]"
-          remote-organization-name: "blacklanternsecurity"
-          remote-repository-name: "CLA"
-          lock-pullrequest-aftermerge: "false"
+  cla:
+    uses: blacklanternsecurity/CLA/.github/workflows/cla-reusable.yml@4f85d3c525483f0f846ef4384a8ece24a3c74375 # 2026-09-29
+    secrets: inherit

.github/workflows/daily-update.yml

@@ -6,6 +6,9 @@ on:
     - cron: '0 6 * * *'
   workflow_dispatch:  # Allow manual trigger
 
+permissions:
+  contents: read
+
 # Prevent concurrent runs from racing to commit/merge
 # cancel-in-progress: false means new runs wait instead of canceling in-progress ones
 concurrency:
@@ -14,31 +17,26 @@ concurrency:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
 
     steps:
     - name: Generate app token
       id: app-token
-      uses: actions/create-github-app-token@v3
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       with:
         app-id: ${{ secrets.CLOUDCHECK_APP_ID }}
         private-key: ${{ secrets.CLOUDCHECK_APP_PRIVATE_KEY }}
 
     - name: Checkout stable branch
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: stable
         token: ${{ steps.app-token.outputs.token }}
 
-    - name: Set up Python
-      uses: actions/setup-python@v7
-      with:
-        python-version: "3.12"
-
     - name: Set up uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Install dependencies
       run: uv sync

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,12 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions: {}
+
+jobs:
+  auto-merge:
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+    uses: blacklanternsecurity/CLA/.github/workflows/dependabot-auto-merge.yml@e532142ee9e7322888f6edc80d9a89e2f8c0d96d # 2026-10-03