Repository navigation
Release 1.0.0 - #3
Merged
Merged
Conversation
Remove the agreement, signatures and the Dependabot auto-merge workflow (D10); they stay in CLA or are retired. Rename the project to release-workflows. Add release.yml (release this repo from stable with its own workflows) and dev-security.yml (dependency review, actionlint, zizmor). Scope the CLA App token to CLA and the calling repository with the permissions it uses. Dependabot cooldown of 7 days; self-repository syntax for local calls.
The caller's pull request commits are read with its own GITHUB_TOKEN, so the App token no longer needs the calling repository or write access to it.
CodeQL default setup was enabled after the last push; reopening the pull request did not start a scan.
The code scanning rule was added to dev-review after the previous push; reopening the pull request did not start a scan.
Split from CLA: release workflows only
en0f
approved these changes
Oct 29, 2026
en0f
left a comment
en0f
left a comment
Contributor
There was a problem hiding this comment.
Approved. Two things to confirm only:
1.) The BLS_RELEASE_APP_ID variable and BLS_RELEASE_PRIVATE_KEY secret are set on the release environment, and that the release App is installed on this repo
2.) that the CLA App has members:read and is installed on the CLA repo, now that its token asks for those permissions explicitly.
Contributor
Author
|
Both confirmed.
The Release run is waiting at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
devtostablefor the first release,v1.0.0.On merge,
release.ymlrunsrelease-checkand the tests, then waits twice at thereleaseenvironment (credentials, then publish). Each approval needs abbot-leadsmember other than whoever triggered the run.bls-releasethen tagsv1.0.0on the merge commit.