From 0fd813031bb6b422fb1005a6df308f0eae172a14 Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Fri, 30 Oct 2026 15:47:49 -0400 Subject: [PATCH 1/3] Bump pytest to 9.0.3 (GHSA-6w46-j5rx-g56g) --- pyproject.toml | 2 +- uv.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index a23a3b4..fdfa6db 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,7 +5,7 @@ requires-python = ">=3.11" dependencies = ["packaging", "pyyaml"] [dependency-groups] -dev = ["pytest==9.0.2", "ruff==0.15.10", "actionlint-py==1.7.12.24"] +dev = ["pytest==9.0.3", "ruff==0.15.10", "actionlint-py==1.7.12.24"] [tool.ruff] line-length = 160 diff --git a/uv.lock b/uv.lock index c54a35c..deb5dd7 100644 --- a/uv.lock +++ b/uv.lock @@ -55,7 +55,7 @@ wheels = [ [[package]] name = "pytest" -version = "9.0.2" +version = "9.0.3" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "colorama", marker = "sys_platform == 'win32'" }, @@ -64,9 +64,9 @@ dependencies = [ { name = "pluggy" }, { name = "pygments" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" } +sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" }, + { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" }, ] [[package]] @@ -149,7 +149,7 @@ requires-dist = [ [package.metadata.requires-dev] dev = [ { name = "actionlint-py", specifier = "==1.7.12.24" }, - { name = "pytest", specifier = "==9.0.2" }, + { name = "pytest", specifier = "==9.0.3" }, { name = "ruff", specifier = "==0.15.10" }, ] From 9973add16e1e3657c3057f016baca8e0b52c23ed Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Thu, 5 Nov 2026 17:12:58 -0500 Subject: [PATCH 2/3] Let other repositories call dev-security.yml Adds workflow_call so a repository's dev ruleset can require dev-security / dependency-review and dev-security / workflow-lint, the policy rule 3 checks, from one shared copy. README documents the caller. Version 1.1.0: a new way to call, nothing a caller must change. --- .github/workflows/dev-security.yml | 2 ++ README.md | 16 ++++++++++++++++ pyproject.toml | 2 +- uv.lock | 2 +- 4 files changed, 20 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml index 7d9a67c..259723d 100644 --- a/.github/workflows/dev-security.yml +++ b/.github/workflows/dev-security.yml @@ -1,7 +1,9 @@ # The automated security review that stands in for a second developer on dev (policy rule 3). +# Other repositories call it from a pull_request workflow; dependency review needs a pull request's base and head. name: dev-security on: pull_request: + workflow_call: permissions: {} diff --git a/README.md b/README.md index aefac0b..8d5c430 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,7 @@ same release controls as the projects it publishes. | Workflow | Purpose | |---|---| | `python-tests.yml`, `python-versions.yml`, `rust-tests.yml` | Test matrices | +| `dev-security.yml` | Dependency review and workflow lint (`actionlint`, `zizmor`), the security checks `dev` requires | | `stable-guard.yml` | Checks a pull request into `stable` is release-ready: a MAJOR.MINOR.PATCH version, matching chart versions, no git dependencies | | `release-check.yml` | Runs on `stable` only: reads the version, refuses a partly published release, checks merged-PR provenance and that the `release` environment is protected | | `maturin-wheels.yml`, `crates.yml`, `docker.yml` | Build and publish artifacts | @@ -29,6 +30,21 @@ jobs: Use the SHA of a `v*` tag of this repository, never a branch. Tags here are created only by the release App and can't be moved or deleted, so a version comment always matches its SHA. +Call `dev-security.yml` from a workflow that runs on `pull_request`, with a job named `dev-security`, so the +checks a `dev` ruleset requires are `dev-security / dependency-review` and `dev-security / workflow-lint`: + +```yaml +on: + pull_request: + +permissions: + contents: read + +jobs: + dev-security: + uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@ # v1.1.0 +``` + `release-check.yml` and `publish.yml` read the release App key in jobs that run in the caller's `release` environment. A reusable workflow gets an environment secret only when the caller passes it, so map it by name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the diff --git a/pyproject.toml b/pyproject.toml index fdfa6db..e91c2f0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "release-workflows" -version = "1.0.0" +version = "1.1.0" requires-python = ">=3.11" dependencies = ["packaging", "pyyaml"] diff --git a/uv.lock b/uv.lock index deb5dd7..f5ad840 100644 --- a/uv.lock +++ b/uv.lock @@ -126,7 +126,7 @@ wheels = [ [[package]] name = "release-workflows" -version = "1.0.0" +version = "1.1.0" source = { virtual = "." } dependencies = [ { name = "packaging" }, From e314ab19d6961ef8bca48b1b1f8e58d5089afe12 Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Fri, 6 Nov 2026 15:15:36 -0500 Subject: [PATCH 3/3] README: put the secret-mapping note back under the example it refers to #11 inserted the dev-security caller between the secrets example and "map it by name as above", so that sentence pointed at a block with no secrets (review note V12 on #12). Text unchanged; only its position moves. --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 8d5c430..8d6e89e 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,11 @@ jobs: Use the SHA of a `v*` tag of this repository, never a branch. Tags here are created only by the release App and can't be moved or deleted, so a version comment always matches its SHA. +`release-check.yml` and `publish.yml` read the release App key in jobs that run in the caller's `release` +environment. A reusable workflow gets an environment secret only when the caller passes it, so map it by +name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the +value; GitHub supplies it inside the environment. + Call `dev-security.yml` from a workflow that runs on `pull_request`, with a job named `dev-security`, so the checks a `dev` ruleset requires are `dev-security / dependency-review` and `dev-security / workflow-lint`: @@ -45,11 +50,6 @@ jobs: uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@ # v1.1.0 ``` -`release-check.yml` and `publish.yml` read the release App key in jobs that run in the caller's `release` -environment. A reusable workflow gets an environment secret only when the caller passes it, so map it by -name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the -value; GitHub supplies it inside the environment. - ## How changes land - `dev`: pull request, required tests and security checks (CodeQL, dependency review, `actionlint`,