zostera / django-icons / 37191840625

100%

push

github

Harden the workflows, and write down the dependency update policy (#659)

Propagated from django-marina, which is the canonical source for these files.
See zostera/django-marina#687 for the reasoning.

A zizmor audit returned the same findings in all five packages, since the
workflows are synced. This fixes the three that are not about pinning: the
dependabot job gates on the pull request author rather than github.actor,
ci.yml declares contents: read instead of inheriting a write-capable token,
and the publishing job no longer restores a shared cache.

MAINTAINING.md gains the Dependency updates section, copied verbatim, as it
takes no per-package substitution.

While copying the two verbatim-synced workflows, this also picks up the
timeout-minutes that marina carries on its dependabot and release jobs and
this repo had lost. PACKAGING.md lists both files as synced identically, so
that was drift rather than an intentional difference.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

53 of 58 branches covered (91.38%)

Branch coverage included in aggregate %.

225 of 229 relevant lines covered (98.25%)

15.72 hits per line