CI: Bump allow-list pin and quieten repeat summaries

[ModeSevenIndustrialSolutions]

CI: Bump allow-list pin and quieten repeat summaries

Two pieces of workflow housekeeping, applied identically across the
*-workflows estate.

1. Allow-list pin → v0.16.1

Repoints the shared lfreleng-actions/.github allow-list at
ec0736244fc776e326283c6af6840e30f316f63c (v0.16.1), up from v0.16.0.

Both forms that carry the reference move together:

Form	Where
allow_list.txt@	the harden_runner_allowlist input default
config: '@'	workflows that take no such input (release-drafter.yaml)

The four release examples under examples/ carry their own copy of the
pin in a HARDEN_RUNNER_ALLOWLIST env var, which their publishing jobs
pass to the loader. Those move too, so a caller copying an example does
not inherit a stale pin.

2. One allow-list summary per workflow

Every job loads the allow-list, and each invocation wrote the same static
block to the job summary — once per job rather than once per run,
crowding out the build, test and audit output a reader came for.

The action already exposes allow_list_summary for exactly this, so this
is configuration rather than a change to it. Suppressed everywhere except
the first invocation in each file.

invocations=32 emitting=5 (one per workflow file)

The most invocations in the estate. Per file:
build-test-release-multiarch.yaml goes from 10 blocks to 1,
build-test-release.yaml from 9 to 1, and both build-test.yaml and
build-test-multiarch.yaml from 6 to 1.

The release examples get the same treatment: each has two local loader
invocations (test-pypi then pypi), so the second is suppressed and
a copied caller emits one local block rather than two.

Scope note: once per workflow, not once per run

These are workflow_call reusable workflows, so they cannot see beyond
themselves. A caller invoking several still receives one block from each.
That is as far as a reusable workflow can enforce on its own behalf — a
large reduction on one per job, but not literally one per run, so worth
stating rather than implying.

Validation

actionlint clean on every workflow; zizmor reports no findings; all
prek hooks pass; aislop ci --changes --base upstream/main → 0 errors,
0 warnings. Verified that no stale allow-list SHA remains and that
exactly one invocation per file still emits.

[Copilot]

🟡 Changes recommended

Four release example workflows still explicitly use the superseded v0.16.0 allow-list pin.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates CI workflow allow-list references and reduces duplicate job summaries.

Changes:

• Pins the shared allow-list to v0.16.1.
• Suppresses repeated allow-list summaries after each workflow’s first invocation.
• Leaves four release examples on the stale v0.16.0 pin.

File summaries

File	Description
.github/workflows/release-drafter.yaml	Updates the direct allow-list reference.
.github/workflows/build-test.yaml	Updates the default pin and suppresses repeated summaries.
.github/workflows/build-test-multiarch.yaml	Updates the default pin and suppresses repeated summaries.
.github/workflows/build-test-release.yaml	Updates release workflow configuration.
.github/workflows/build-test-release-multiarch.yaml	Updates multi-architecture release configuration.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Each release example still emits duplicate local allow-list summaries from its two publishing jobs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 4
• Review effort level: Balanced

[Copilot]

🟢 Approval recommended

The verified pin and summary settings consistently implement the stated workflow housekeeping.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[zxiiro]

🤖 Auto-approved by agent: code-reviewed low risk. Same allow-list pin bump (v0.16.0→v0.16.1) + allow_list_summary:false as the noon series; Multi-Arch CI now green.