From 9973add16e1e3657c3057f016baca8e0b52c23ed Mon Sep 17 00:00:00 2001
From: Philip Hartlieb <philip@blacklanternsecurity.com>
Date: Thu, 5 Nov 2026 17:12:58 -0500
Subject: [PATCH] Let other repositories call dev-security.yml

Adds workflow_call so a repository's dev ruleset can require dev-security / dependency-review and dev-security / workflow-lint, the policy rule 3 checks, from one shared copy. README documents the caller. Version 1.1.0: a new way to call, nothing a caller must change.
---
 .github/workflows/dev-security.yml |  2 ++
 README.md                          | 16 ++++++++++++++++
 pyproject.toml                     |  2 +-
 uv.lock                            |  2 +-
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml
index 7d9a67c..259723d 100644
--- a/.github/workflows/dev-security.yml
+++ b/.github/workflows/dev-security.yml
@@ -1,7 +1,9 @@
 # The automated security review that stands in for a second developer on dev (policy rule 3).
+# Other repositories call it from a pull_request workflow; dependency review needs a pull request's base and head.
 name: dev-security
 on:
   pull_request:
+  workflow_call:
 
 permissions: {}
 
diff --git a/README.md b/README.md
index aefac0b..8d5c430 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,7 @@ same release controls as the projects it publishes.
 | Workflow | Purpose |
 |---|---|
 | `python-tests.yml`, `python-versions.yml`, `rust-tests.yml` | Test matrices |
+| `dev-security.yml` | Dependency review and workflow lint (`actionlint`, `zizmor`), the security checks `dev` requires |
 | `stable-guard.yml` | Checks a pull request into `stable` is release-ready: a MAJOR.MINOR.PATCH version, matching chart versions, no git dependencies |
 | `release-check.yml` | Runs on `stable` only: reads the version, refuses a partly published release, checks merged-PR provenance and that the `release` environment is protected |
 | `maturin-wheels.yml`, `crates.yml`, `docker.yml` | Build and publish artifacts |
@@ -29,6 +30,21 @@ jobs:
 Use the SHA of a `v*` tag of this repository, never a branch. Tags here are created only by the release
 App and can't be moved or deleted, so a version comment always matches its SHA.
 
+Call `dev-security.yml` from a workflow that runs on `pull_request`, with a job named `dev-security`, so the
+checks a `dev` ruleset requires are `dev-security / dependency-review` and `dev-security / workflow-lint`:
+
+```yaml
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@<full sha of the tag> # v1.1.0
+```
+
 `release-check.yml` and `publish.yml` read the release App key in jobs that run in the caller's `release`
 environment. A reusable workflow gets an environment secret only when the caller passes it, so map it by
 name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the
diff --git a/pyproject.toml b/pyproject.toml
index fdfa6db..e91c2f0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "release-workflows"
-version = "1.0.0"
+version = "1.1.0"
 requires-python = ">=3.11"
 dependencies = ["packaging", "pyyaml"]
 
diff --git a/uv.lock b/uv.lock
index deb5dd7..f5ad840 100644
--- a/uv.lock
+++ b/uv.lock
@@ -126,7 +126,7 @@ wheels = [
 
 [[package]]
 name = "release-workflows"
-version = "1.0.0"
+version = "1.1.0"
 source = { virtual = "." }
 dependencies = [
     { name = "packaging" },