feat: let other repositories call dev-security.yml

.github/workflows/dev-security.yml

@@ -1,7 +1,9 @@
 # The automated security review that stands in for a second developer on dev (policy rule 3).
+# Other repositories call it from a pull_request workflow; dependency review needs a pull request's base and head.
 name: dev-security
 on:
   pull_request:
+  workflow_call:
 
 permissions: {}
 

README.md

@@ -7,6 +7,7 @@ same release controls as the projects it publishes.
 | Workflow | Purpose |
 |---|---|
 | `python-tests.yml`, `python-versions.yml`, `rust-tests.yml` | Test matrices |
+| `dev-security.yml` | Dependency review and workflow lint (`actionlint`, `zizmor`), the security checks `dev` requires |
 | `stable-guard.yml` | Checks a pull request into `stable` is release-ready: a MAJOR.MINOR.PATCH version, matching chart versions, no git dependencies |
 | `release-check.yml` | Runs on `stable` only: reads the version, refuses a partly published release, checks merged-PR provenance and that the `release` environment is protected |
 | `maturin-wheels.yml`, `crates.yml`, `docker.yml` | Build and publish artifacts |
@@ -29,6 +30,21 @@ jobs:
 Use the SHA of a `v*` tag of this repository, never a branch. Tags here are created only by the release
 App and can't be moved or deleted, so a version comment always matches its SHA.
 
+Call `dev-security.yml` from a workflow that runs on `pull_request`, with a job named `dev-security`, so the
+checks a `dev` ruleset requires are `dev-security / dependency-review` and `dev-security / workflow-lint`:
+
+```yaml
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@<full sha of the tag> # v1.1.0
+```
+
 `release-check.yml` and `publish.yml` read the release App key in jobs that run in the caller's `release`
 environment. A reusable workflow gets an environment secret only when the caller passes it, so map it by
 name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "release-workflows"
-version = "1.0.0"
+version = "1.1.0"
 requires-python = ">=3.11"
 dependencies = ["packaging", "pyyaml"]