Release 1.1.0

.github/workflows/dev-security.yml

@@ -1,7 +1,9 @@
 # The automated security review that stands in for a second developer on dev (policy rule 3).
+# Other repositories call it from a pull_request workflow; dependency review needs a pull request's base and head.
 name: dev-security
 on:
   pull_request:
+  workflow_call:
 
 permissions: {}
 

README.md

@@ -7,6 +7,7 @@ same release controls as the projects it publishes.
 | Workflow | Purpose |
 |---|---|
 | `python-tests.yml`, `python-versions.yml`, `rust-tests.yml` | Test matrices |
+| `dev-security.yml` | Dependency review and workflow lint (`actionlint`, `zizmor`), the security checks `dev` requires |
 | `stable-guard.yml` | Checks a pull request into `stable` is release-ready: a MAJOR.MINOR.PATCH version, matching chart versions, no git dependencies |
 | `release-check.yml` | Runs on `stable` only: reads the version, refuses a partly published release, checks merged-PR provenance and that the `release` environment is protected |
 | `maturin-wheels.yml`, `crates.yml`, `docker.yml` | Build and publish artifacts |
@@ -34,6 +35,21 @@ environment. A reusable workflow gets an environment secret only when the caller
 name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the
 value; GitHub supplies it inside the environment.
 
+Call `dev-security.yml` from a workflow that runs on `pull_request`, with a job named `dev-security`, so the
+checks a `dev` ruleset requires are `dev-security / dependency-review` and `dev-security / workflow-lint`:
+
+```yaml
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@<full sha of the tag> # v1.1.0
+```
+
 ## How changes land
 
 - `dev`: pull request, required tests and security checks (CodeQL, dependency review, `actionlint`,

pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "release-workflows"
-version = "1.0.0"
+version = "1.1.0"
 requires-python = ">=3.11"
 dependencies = ["packaging", "pyyaml"]
 
 [dependency-groups]
-dev = ["pytest==9.0.2", "ruff==0.15.10", "actionlint-py==1.7.12.24"]
+dev = ["pytest==9.0.3", "ruff==0.15.10", "actionlint-py==1.7.12.24"]
 
 [tool.ruff]
 line-length = 160