[pjhartlieb]

Splits the reusable workflows out of CLA. The agreement and signatures stay in CLA.

• Removes ICLA.md, signatures/ and dependabot-auto-merge.yml (Dependabot pull requests are merged by a person).
• Renames the project to release-workflows.
• Adds release.yml: on a merge to stable, runs this repo's own release-check.yml, tests and publish.yml. The tag is created by the release App after the release environment is approved.
• Adds dev-security.yml: dependency review, actionlint, zizmor.
• cla-reusable.yml: the App token is scoped to CLA and the calling repository, with contents write, members read and pull requests read. It previously covered every repository with all of the App's permissions.
• Two zizmor findings are ignored inline, each with its reason: the archived CLA action, and toJSON(secrets) in python-tests.yml.
• Dependabot cooldown of 7 days; local workflow calls use $/.

Local: pytest 41 passed, ruff clean, actionlint clean, zizmor 1.31.1 no findings (2 ignored).

[en0f]

Approved, but a few items worth confirming:

1.) CLA token scoping (cla-reusable.yml). repositories: CLA,${{ github.event.repository.name }} only works if the CLA App is installed on every repo that calls this workflow. Before this change the token covered the App’s whole installation, so it didn’t matter which repo called it. Now, any caller repo outside the installation makes the token step fail. The CLA job then never posts a status, and outside PRs on that repo get stuck. Check the App’s installation list against the repos that call this workflow.

2.) Same file, smaller point. permission-contents: write now also applies to the calling repo, not just CLA. Only CLA needs write access. Using two tokens would fix that, but nothing breaks if you leave it.

Worth noting:
release-check.yml fails the run if any of these are missing:

a.) A release environment exists, limited to the stable branch only, with admin bypass turned off.
b.) If the repo is public, that environment has required reviewers and “prevent self-review” turned on.
c.) The BLS_RELEASE_APP_ID variable and the BLS_RELEASE_PRIVATE_KEY environment secret are set.

FYI:

• pyproject.toml is still at 0.0.0. The first merge to stable would create tag v0.0.0 unless the version is bumped first. The README’s pinning example uses v1.0.0.
• Each release will ask for approval twice. release-check.yml (its credentials job) and publish.yml both run in the release environment. That’s existing behaviour, but the README describes a single bbot-leads approval.
• The README says CodeQL is a required check on dev, but no CodeQL check ran on this PR. Either it isn’t set up or the README is wrong.