From b95e7e8f16959ae9640a1d2ac5f5fe77707fa7f1 Mon Sep 17 00:00:00 2001
From: Philip Hartlieb <philip@blacklanternsecurity.com>
Date: Mon, 9 Nov 2026 10:47:16 -0500
Subject: [PATCH 1/2] Run dependency review and workflow lint on pull requests

Calls release-workflows dev-security.yml (v1.1.0), the security checks policy rule 3 requires on dev. Fixes what zizmor reports: the CLA triggers are marked as reviewed (cla-reusable.yml never checks out pull request code), benchmark checkouts drop persisted credentials, and publish.yml's local workflow calls are marked as reviewed (same-repository calls on stable).
---
 .github/workflows/cla.yml          |  5 +++--
 .github/workflows/dev-security.yml | 11 +++++++++++
 .github/workflows/publish.yml      |  4 ++--
 3 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/dev-security.yml

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index e30d6f9..edcd49f 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -1,9 +1,10 @@
 name: CLA
 
+# The CLA bot needs both triggers; cla-reusable.yml never checks out pull request code.
 on:
-  issue_comment:
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, closed, synchronize]
 
 permissions:
diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml
new file mode 100644
index 0000000..b674f80
--- /dev/null
+++ b/.github/workflows/dev-security.yml
@@ -0,0 +1,11 @@
+name: dev-security
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@12139195c6f35d8b4478bb8ec3df94aa275da01e # v1.1.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 52d51fc..5313082 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,14 +25,14 @@ jobs:
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/tests.yml
+    uses: ./.github/workflows/tests.yml # zizmor: ignore[self-repository]
 
   rust-tests:
     needs: check
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/rust-tests.yml
+    uses: ./.github/workflows/rust-tests.yml # zizmor: ignore[self-repository]
 
   wheels:
     needs: [tests, rust-tests]

From 142c46348dc369f14fd351ceade7d13e62ec7e13 Mon Sep 17 00:00:00 2001
From: Philip Hartlieb <philip@blacklanternsecurity.com>
Date: Mon, 9 Nov 2026 11:42:27 -0500
Subject: [PATCH 2/2] Wait 7 days before Dependabot proposes a new release

zizmor dependabot-cooldown (the workflow-lint check): version updates now wait 7 days after a release is published, so a compromised release has time to be caught and pulled before it is proposed here. Security updates are not delayed.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e6f502c..d74f061 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,6 +17,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "pip"
     directory: "/"
     target-branch: "dev"
@@ -34,6 +36,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     target-branch: "dev"
@@ -51,3 +55,5 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7