From 458bbbc0ea789a17758459d87fd39c008b90d9f9 Mon Sep 17 00:00:00 2001
From: edgecasehuman <309310929+edgecasehuman@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:25:29 -0500
Subject: [PATCH 1/3] Add CodeQL security analysis

---
 .github/workflows/codeql.yml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..7093acf
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        with:
+          languages: rust
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4

From 7f10a66ca2dec0e6eabf5d2f42c639cd7e308720 Mon Sep 17 00:00:00 2001
From: edgecasehuman <309310929+edgecasehuman@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:26:19 -0500
Subject: [PATCH 2/3] Gate releases through the release environment

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9178788..906cac9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,7 @@ jobs:
     # is the branch name, and `gh release create` would tag the branch.
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: windows-latest
+    environment: release
     timeout-minutes: 30
     permissions:
       contents: write

From 1f224c7b16ed5296e42ffa3d116e3402f071926b Mon Sep 17 00:00:00 2001
From: edgecasehuman <309310929+edgecasehuman@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:30:20 -0500
Subject: [PATCH 3/3] Run required security audit on every pull request

---
 .github/workflows/audit.yml | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 5de6699..57046c5 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -5,17 +5,12 @@ name: Security audit
 # pinned here, which no dependency update would surface. The schedule is what
 # makes that useful, so it runs weekly as well as on dependency changes.
 on:
+  # Keep this check present on every pull request because branch protection
+  # requires it, and dependency risk can enter through source or workflow
+  # changes even when Cargo.toml/Cargo.lock are untouched.
   pull_request:
-    paths:
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/workflows/audit.yml"
   push:
     branches: [main]
-    paths:
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/workflows/audit.yml"
   schedule:
     - cron: "0 7 * * 1"
   workflow_dispatch: