Split from CLA: release workflows only

.github/dependabot.yml

@@ -8,3 +8,5 @@ updates:
           - "*"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/cla-reusable.yml

@@ -23,19 +23,24 @@ jobs:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: blacklanternsecurity
+          # Only CLA, which holds the signatures. The caller's pull request is read with its own GITHUB_TOKEN.
+          repositories: CLA
+          permission-contents: write
+          permission-members: read
 
       - name: Check all committers against org and allowlist
         id: cla-check
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           if [ "${{ github.event_name }}" = "pull_request_target" ]; then
             PR_NUM="${{ github.event.pull_request.number }}"
           else
             PR_NUM="${{ github.event.issue.number }}"
           fi
 
-          COMMITTERS=$(gh api "repos/${{ github.repository }}/pulls/$PR_NUM/commits" --paginate --jq '.[].author.login' | sort -u)
+          COMMITTERS=$(GH_TOKEN="$PR_TOKEN" gh api "repos/${{ github.repository }}/pulls/$PR_NUM/commits" --paginate --jq '.[].author.login' | sort -u)
           ALL_EXEMPT=true
           EXEMPT_LOGINS=""
 
@@ -90,7 +95,8 @@ jobs:
         if: |
           (steps.cla-check.outputs.all_exempt != 'true') &&
           ((github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target')
-        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        # Upstream is archived with no maintained successor; replacing it is tracked with the CLA cleanup.
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1 # zizmor: ignore[archived-uses]
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PERSONAL_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/dev-security.yml

@@ -0,0 +1,37 @@
+# The automated security review that stands in for a second developer on dev (policy rule 3).
+name: dev-security
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+
+  workflow-lint:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: actionlint
+        env:
+          VERSION: 1.7.12
+          SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        run: |
+          curl -fsSLo actionlint.tgz "https://github.com/rhysd/actionlint/releases/download/v${VERSION}/actionlint_${VERSION}_linux_amd64.tar.gz"
+          echo "${SHA256}  actionlint.tgz" | sha256sum -c -
+          tar xzf actionlint.tgz actionlint
+          ./actionlint -color
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false

.github/workflows/python-tests.yml

@@ -94,7 +94,8 @@
           python-version: ${{ matrix.python-version }}
       - if: inputs.secret-env != '[]'
         env:
-          SECRETS: ${{ toJSON(secrets) }}
+          # Only the secrets declared above reach a reusable workflow; secret-env picks from those by name.
+          SECRETS: ${{ toJSON(secrets) }} # zizmor: ignore[overprovisioned-secrets]
           NAMES: ${{ inputs.secret-env }}
         run: |
           python3 - <<'PY'

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+# Releases this repository on a merge to stable, with its own workflows (publishing policy rules 1-2).
+name: Release
+on:
+  push:
+    branches: [stable]
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  check:
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: read
+    uses: $/.github/workflows/release-check.yml
+
+  tests:
+    needs: check
+    if: needs.check.outputs.release == 'true'
+    permissions:
+      contents: read
+    uses: $/.github/workflows/tests.yml
+
+  release:
+    needs: [check, tests]
+    if: needs.check.outputs.release == 'true'
+    permissions:
+      contents: read
+    uses: $/.github/workflows/publish.yml
+    with:
+      version: ${{ needs.check.outputs.version }}
+      tag: ${{ needs.check.outputs.tag }}

.github/workflows/tests.yml

@@ -2,14 +2,15 @@ name: Tests
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [dev]
+  workflow_call:
 
 permissions:
   contents: read
 
 jobs:
   python:
-    uses: ./.github/workflows/python-tests.yml
+    uses: $/.github/workflows/python-tests.yml
     with:
       uv-sync-args: --group dev
 

README.md

@@ -0,0 +1,48 @@
+# release-workflows
+
+Reusable GitHub Actions workflows that Black Lantern Security repositories call to test, build, check and
+publish releases. Callers execute this code with their own permissions and secrets, so it is held to the
+same release controls as the projects it publishes.
+
+| Workflow | Purpose |
+|---|---|
+| `python-tests.yml`, `python-versions.yml`, `rust-tests.yml` | Test matrices |
+| `stable-guard.yml` | Checks a pull request into `stable` is release-ready: a MAJOR.MINOR.PATCH version, matching chart versions, no git dependencies |
+| `release-check.yml` | Runs on `stable` only: reads the version, refuses a partly published release, checks merged-PR provenance and that the `release` environment is protected |
+| `maturin-wheels.yml`, `crates.yml`, `docker.yml` | Build and publish artifacts |
+| `docker-dev.yml` | `dev` channel images on GHCR (not releases) |
+| `publish.yml` | Creates the tag and GitHub release with the release App, after everything is published |
+| `cla-reusable.yml` | CLA check. The agreement and signatures live in [`CLA`](https://github.com/blacklanternsecurity/CLA) |
+
+## Using a workflow
+
+Pin a release by full commit SHA, with the version as a comment:
+
+```yaml
+jobs:
+  check:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/release-check.yml@<full sha of the tag> # v1.0.0
+```
+
+Use the SHA of a `v*` tag of this repository, never a branch. Tags here are created only by the release
+App and can't be moved or deleted, so a version comment always matches its SHA.
+
+## How changes land
+
+- `dev`: pull request, required tests and security checks (CodeQL, dependency review, `actionlint`,
+  `zizmor`). No approval needed.
+- `stable`: pull request from `dev`, approved by a code owner other than the last pusher, required checks.
+  Nobody bypasses it.
+- A merge to `stable` runs `release.yml`, which tags the merge commit `v<version>` from `pyproject.toml`.
+  It stops twice at the `release` environment, once before checking the release credentials and once
+  before publishing, and each stop needs a `bbot-leads` approval.
+
+Versions follow semantic versioning: a change to a workflow's inputs, outputs, secrets or required
+permissions that a caller must act on is a major version.
+
+## Tests
+
+```bash
+uv run --group dev pytest
+uv run --group dev actionlint
+```

pyproject.toml

@@ -1,5 +1,5 @@
 [project]
-name = "shared-workflows"
+name = "release-workflows"
 version = "0.0.0"
 requires-python = ">=3.11"
 dependencies = ["packaging", "pyyaml"]