What's Changed

• docs(security-suite): record why ref creation is exempt from the workflow rule by @dkastl in #108
• chore: sync workflow-template pins to v1.36.0 by @workflows-geolonia[bot] in #104
• chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #107
• chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #106
• chore(deps): bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #109
• chore(secret-leak): bump betterleaks v1.6.1 to v1.7.0 by @dkastl in #110

Full Changelog: v1.36.0...v1.37.0

What's Changed

• ci: scheduled Sync workflow-template pins job by @dkastl in #100
• chore: sync workflow-template pins to v1.35.0 by @workflows-geolonia[bot] in #101
• feat(security-suite): single source of truth for scanner configs (phase 1: betterleaks base + pinact dedup) by @dkastl in #102
• refactor(secret-leak): delete duplicate betterleaks/default.toml; dependabot drop-in header by @dkastl in #103

New Contributors

• @workflows-geolonia[bot] made their first contribution in #101

Full Changelog: v1.35.0...v1.36.0

What's Changed

• Harden sync-team-access workflow template (explicit perms + secrets) by @dkastl in #98
• chore(deps): bump the github-actions group across 1 directory with 4 updates by @dependabot[bot] in #97
• chore(betterleaks): bump v1.5.0 → v1.6.1 by @dkastl in #99

Full Changelog: v1...v1.35.0

What's Changed

• feat(techdocs): allow AWS account ID via vars (drop caller secrets block) by @dkastl in #95

Full Changelog: v1...v1.34.0

What's Changed

• feat: fail the Security Suite on error-severity findings by @dkastl in #93

Full Changelog: v1...v1.33.0

What's Changed

• fix: float suite refs on @v1 + keep v1 lightweight + document the real root cause by @dkastl in #92

Full Changelog: v1.31...v1.32.0

What's Changed

• fix: bump required-workflow ref to v1.30.0 (whole tree now immutable) [2/2] by @dkastl in #90

Full Changelog: v1...v1.31.0

What's Changed

• fix: SHA-pin suite sub-reusables (required-workflow tree must be immutable) [1/2] by @dkastl in #89

Full Changelog: v1...v1.30.0

What's Changed

• fix: pin required-workflow reusable ref to a SHA (unbreak org-wide Security Suite) by @dkastl in #88

Full Changelog: v1...v1.29.0

What's Changed

• fix: drive geolonia/.github zizmor findings to zero (harden shared workflows) by @dkastl in #87

Full Changelog: v1...v1.28.0