feat: go back to the moving v1 tag for callers

.github/workflows/codeql.yml

@@ -77,12 +77,35 @@ jobs:
           esac
           echo "mode=$m" >> "$GITHUB_OUTPUT"
 
+      # Callers reference these workflows by the moving v1 tag on purpose, so
+      # actions/unpinned-tag would flag every caller. zizmor requires a SHA for
+      # every other action. `config` takes precedence over `config-file`, so the
+      # caller's file is merged in here.
+      - name: Config
+        id: config
+        env:
+          CONFIG_FILE: ${{ inputs.config-file }}
+        run: |
+          set -euo pipefail
+          filter='{"exclude": {"id": "actions/unpinned-tag"}}'
+          if [ -n "$CONFIG_FILE" ]; then
+            config="$(yq -o yaml ".\"query-filters\" += [$filter]" "$CONFIG_FILE")"
+          else
+            config="$(yq -n -o yaml ".\"query-filters\" = [$filter]")"
+          fi
+          echo "$config"
+          {
+            echo "config<<EOF_CODEQL_CONFIG"
+            echo "$config"
+            echo "EOF_CODEQL_CONFIG"
+          } >> "$GITHUB_OUTPUT"
+
       - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ steps.mode.outputs.mode }}
           queries: ${{ inputs.queries }}
-          config-file: ${{ inputs.config-file }}
+          config: ${{ steps.config.outputs.config }}
 
       - name: Build (manual)
         if: steps.mode.outputs.mode == 'manual'

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v1.1.1
+
+- Callers use the moving `@v1` tag again, as in v1.0. v1.1.0 asked for a commit SHA per caller, which meant a pull request in every repository for each release. `templates/zizmor.yml` allows a tag for `privacybydesign/*` again and still requires a SHA for every other action.
+- `codeql.yml` no longer runs `actions/unpinned-tag`, which would flag every `@v1` reference. zizmor covers third-party actions. A caller's `config-file` is merged with this filter.
+
 ## v1.1.0
 
 All changes are backwards compatible for v1.0 callers: new inputs default
@@ -56,9 +61,7 @@ marked ⚠.
 - Status checks templates for Go and Node with one required gate job, **`Status checks passed`**, and `merge_group` triggers.
 - Delivery template: PR scanning moved to Status checks, the weekly schedule moved to Image rescan.
 - New templates: image rescan, GHCR clean-up, OpenSSF Scorecard; Go release template uses tag push.
-- `templates/dependabot.yml` (actions, Docker digests, Go, npm, Terraform; grouped; 7-day cooldown).
-- Callers pin the shared workflows to a commit SHA with a `# vX.Y.Z` comment instead of `@v1`; `templates/zizmor.yml` requires a SHA for every `uses:`. There is no moving `v1` tag.
-- `org-settings/`: allowed actions, rulesets, security configuration, apply script with `baseline`, `opt-in` and `strict` phases.
+- `templates/dependabot.yml` (actions, Docker digests, Go, npm, Terraform; grouped; 7-day cooldown).- `org-settings/`: allowed actions, rulesets, security configuration, apply script with `baseline`, `opt-in` and `strict` phases.
 
 ## v1.0.0
 - Initial release: docker-publish, go-checks, go-release, node-checks, npm-publish, terraform, pr-title, release-please.

README.md

@@ -2,8 +2,6 @@
 
 Reusable GitHub Actions workflows for the [privacybydesign](https://github.com/privacybydesign) (Yivi) repositories.
 
-Status: in development, not released yet.
-
 ## Workflows
 
 | Workflow | What it does |
@@ -24,25 +22,25 @@ Status: in development, not released yet.
 
 ## Usage
 
-Call a workflow from a job in your repository, pinned to the commit SHA of a release:
+Call a workflow from a job in your repository:
 
 ```yaml
 jobs:
   go:
-    uses: privacybydesign/github-workflows/.github/workflows/go-checks.yml@<commit-sha> # v1.1.0
+    uses: privacybydesign/github-workflows/.github/workflows/go-checks.yml@v1
     permissions:
       contents: read
 ```
 
-Copy [`templates/dependabot.yml`](templates/dependabot.yml) and [`templates/zizmor.yml`](templates/zizmor.yml) to your `.github/` directory: Dependabot then bumps the SHA and the version comment when a new release comes out, and zizmor rejects workflows and actions that are not pinned to a SHA.
+Copy [`templates/dependabot.yml`](templates/dependabot.yml) and [`templates/zizmor.yml`](templates/zizmor.yml) to your `.github/` directory: Dependabot keeps your third-party actions pinned and current, and zizmor allows `@v1` for these workflows but requires a commit SHA for every other action.
 
 The inputs of each workflow are documented in its file, under `on.workflow_call.inputs`. A reusable workflow gets no more permissions than the calling job grants, so grant the ones its file lists.
 
 On private repositories, artifact attestations are skipped, and `codeql.yml` and `dependency-review.yml` need GitHub Code Security.
 
 ## Versioning
 
-Releases are semver tags (`v1.2.0`); breaking changes get a new major. There is no moving major tag: callers pin a commit SHA, so a release can't change under them. Third-party actions in these workflows are pinned the same way and kept up to date by Dependabot. See [CHANGELOG.md](CHANGELOG.md).
+Releases are semver tags (`v1.2.0`) with a moving major tag (`v1`), so a release reaches every caller without a change in each repository; breaking changes get a new major. Only maintainers can move `v1`, and changes are tried from a canary repository first. Third-party actions in these workflows are pinned to commit SHAs and kept up to date by Dependabot. See [CHANGELOG.md](CHANGELOG.md).
 
 ## License
 

templates/zizmor.yml

@@ -3,6 +3,7 @@ rules:
   unpinned-uses:
     config:
       policies:
-        # Every action and reusable workflow, our own included, must be pinned
-        # to a full commit SHA (with a "# vX.Y.Z" comment for Dependabot).
+        # Our own reusable workflows are referenced by the moving major tag (v1).
+        privacybydesign/*: ref-pin
+        # Everything else must be pinned to a full commit SHA.
         "*": hash-pin

zizmor.yml

@@ -3,6 +3,7 @@ rules:
   unpinned-uses:
     config:
       policies:
-        # Every action and reusable workflow, our own included, must be pinned
-        # to a full commit SHA (with a "# vX.Y.Z" comment for Dependabot).
+        # Our own reusable workflows are referenced by the moving major tag (v1).
+        privacybydesign/*: ref-pin
+        # Everything else must be pinned to a full commit SHA.
         "*": hash-pin