feat: add opt-in README SHA update to release workflow

[felickz]

Summary

Adds a new update-readme-sha boolean input to the reusable release workflow. When enabled, it opens a PR to update SHA-pinned action references in README.md after the release is created.

New input

Input	Type	Default	Description
update-readme-sha	boolean	false	Open a PR to update SHA-pinned action refs in README.md

Behavior

• Only runs for non-prerelease releases
• Finds owner/repo@<sha> # v<version> patterns in README.md and updates them
• Opens a PR via create-pull-request with the documentation label
• No-ops if no SHA references found in README

Usage

jobs:
  release:
    uses: advanced-security/reusable-workflows/.github/workflows/release.yml@main
    with:
      bump: patch
      update-readme-sha: true

Motivation

Replaces the need for a separate update-readme-sha.yml workflow in each action repo (like secret-scanning-review-action#83). Consolidates the release + README update into a single reusable workflow call.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/peter-evans/create-pull-request	8.1.1	🟢 4.7	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 3 Found 5/13 approved changesets -- score normalized to 3 Maintained 🟢 10 12 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy ⚠️ 0 security policy file not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
actions/peter-evans/create-pull-request	5f6978faf089d4d20b00c7766989d076bb2fc7f1	🟢 4.7	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 3 Found 5/13 approved changesets -- score normalized to 3 Maintained 🟢 10 12 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy ⚠️ 0 security policy file not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/release.yml