chore: release-infra hardening — sigstore attach on dispatch, wildcard langchain ignore, codeql name

.github/dependabot.yml

@@ -22,16 +22,14 @@ updates:
           - patch
           - minor
     ignore:
-      # LangChain 0.4.x requires a coordinated port — handled manually.
-      - dependency-name: langchain
-        update-types: [version-update:semver-major]
-      - dependency-name: langchain-core
-        update-types: [version-update:semver-major]
-      - dependency-name: langchain-openai
-        update-types: [version-update:semver-major]
-      - dependency-name: langchain-anthropic
-        update-types: [version-update:semver-major]
-      - dependency-name: langchain-community
+      # LangChain-family major bumps require a coordinated port; the LLMClient
+      # abstraction in src/iac_scanner/llm/providers.py is where that lands.
+      # Wildcard "langchain*" covers current and future family members
+      # (langchain-google-*, langchain-xai, langchain-mistralai, etc.) so we
+      # don't have to enumerate one-by-one. History: v0.5.0 had to close
+      # #10 (langchain group major) and #23 (langchain-ollama 0.2→1.1) because
+      # the previous per-package ignore list didn't cover langchain-ollama.
+      - dependency-name: "langchain*"
         update-types: [version-update:semver-major]
 
   - package-ecosystem: github-actions

.github/workflows/codeql.yml

@@ -24,19 +24,20 @@ jobs:
     permissions:
       security-events: write
       packages: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ["python"]
+    # Deliberately no `strategy.matrix` — the workflow only analyzes one
+    # language today. Previously a single-element matrix caused GitHub to
+    # render the check as "Analyze (python) (python)" (matrix name appended
+    # to the job name), which then had to be encoded verbatim in branch
+    # protection. If a second language is added, re-introduce a matrix and
+    # change `name:` above to just "Analyze" so the render is `Analyze (foo)`.
 
     steps:
       - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
-          languages: ${{ matrix.language }}
+          languages: python
           queries: +security-and-quality
 
       - name: Autobuild
@@ -45,4 +46,4 @@ jobs:
       - name: Perform CodeQL analysis
         uses: github/codeql-action/analyze@v4
         with:
-          category: "/language:${{ matrix.language }}"
+          category: "/language:python"

.github/workflows/publish-pypi.yml

@@ -105,11 +105,21 @@ jobs:
             ./dist/*.whl
             ./sbom.cdx.json
       - name: Attach signed artifacts + SBOM to the GitHub Release
-        if: github.event_name == 'release'
+        # Runs on `release: published` (normal tag-triggered flow) AND on
+        # `workflow_dispatch` when dispatched against a v* tag ref (manual
+        # re-publish). The previous gate was `event_name == 'release'` only —
+        # v0.5.0's manual re-dispatch skipped this step, leaving the Release
+        # with no sigstore bundles until they were attached by hand.
+        if: >-
+          github.event_name == 'release' ||
+          (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/'))
         env:
           GH_TOKEN: ${{ github.token }}
+          # `github.event.release.tag_name` exists on release events;
+          # `github.ref_name` (e.g. "v0.5.1") is the tag on workflow_dispatch.
+          TAG_NAME: ${{ github.event.release.tag_name || github.ref_name }}
         run: |
-          gh release upload "${{ github.event.release.tag_name }}" \
+          gh release upload "$TAG_NAME" \
             ./dist/*.tar.gz ./dist/*.whl \
             ./dist/*.sigstore \
             ./sbom.cdx.json \

scripts/apply_branch_protection.sh

@@ -23,6 +23,12 @@ echo "Applying branch protection to ${REPO}@${BRANCH}"
 
 # Required status check contexts. These must match the `name:` of jobs in your
 # workflows. If you rename a job, update both here and the workflow.
+#
+# History: "Analyze (python)" was previously "Analyze (python) (python)"
+# because codeql.yml used a single-element matrix that appended `(python)`
+# to the job name. codeql.yml was normalized in v0.5.1 — repos that ran
+# this script before that change need to re-run it to pick up the corrected
+# context, otherwise merges will block waiting on the stale check name.
 read -r -d '' PAYLOAD <<JSON || true
 {
   "required_status_checks": {