From f938812765bddf48999d82c1da637e0151305611 Mon Sep 17 00:00:00 2001
From: Katie McLaughlin <katie@glasnt.com>
Date: Mon, 14 Sep 2026 11:56:18 +0800
Subject: [PATCH 1/3] feat: add "ready" action - add label when all workflows
 green

---
 .github/workflows/pr-ready.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/pr-ready.yml

diff --git a/.github/workflows/pr-ready.yml b/.github/workflows/pr-ready.yml
new file mode 100644
index 00000000..a2d41650
--- /dev/null
+++ b/.github/workflows/pr-ready.yml
@@ -0,0 +1,28 @@
+name: Mark Ready when all Green
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types:
+      - completed
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    steps:
+      - name: Add label to PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prs = context.payload.workflow_run.pull_requests;
+            if (!prs.length) return;
+            
+            for (const pr of prs) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                labels: ['Ready']
+              });
+            }

From 68039007794f06bf043fd27db9045f6452c2bfd6 Mon Sep 17 00:00:00 2001
From: Katie McLaughlin <katie@glasnt.com>
Date: Mon, 14 Sep 2026 13:24:32 +0800
Subject: [PATCH 2/3] zizmor updates

---
 .github/workflows/pr-ready.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-ready.yml b/.github/workflows/pr-ready.yml
index a2d41650..92ca3a1a 100644
--- a/.github/workflows/pr-ready.yml
+++ b/.github/workflows/pr-ready.yml
@@ -1,7 +1,7 @@
 name: Mark Ready when all Green
 
 on:
-  workflow_run:
+  workflow_call:
     workflows: ["CI"]
     types:
       - completed
@@ -10,14 +10,15 @@ jobs:
   label:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    permissions:
+      contents: read
     steps:
       - name: Add label to PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9.0.0
         with:
           script: |
-            const prs = context.payload.workflow_run.pull_requests;
+            const prs = context.payload.workflow_call.pull_requests;
             if (!prs.length) return;
-            
             for (const pr of prs) {
               await github.rest.issues.addLabels({
                 owner: context.repo.owner,

From efc91c0c7f87b35ae5672e139049d95851cc6db2 Mon Sep 17 00:00:00 2001
From: Katie McLaughlin <katie@glasnt.com>
Date: Mon, 14 Sep 2026 13:27:21 +0800
Subject: [PATCH 3/3] hash

---
 .github/workflows/pr-ready.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-ready.yml b/.github/workflows/pr-ready.yml
index 92ca3a1a..f6a9c44c 100644
--- a/.github/workflows/pr-ready.yml
+++ b/.github/workflows/pr-ready.yml
@@ -14,7 +14,7 @@ jobs:
       contents: read
     steps:
       - name: Add label to PR
-        uses: actions/github-script@v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const prs = context.payload.workflow_call.pull_requests;