Done. • Found the security scan workflow at `OpenHands/software-agent-sdk`:

.github/workflows/security-scan.yml

. • Updated the suitable repo only:

OpenHands/software-agent-sdk

(cloned locally as

/workspace/agent-sdk

). No

OpenHands/extensions

changes were needed. • Changed: ◦

.github/workflows/prepare-release.yml

▪︎ Adds

security-scan

as the fourth label on release PR creation. ▪︎ Adds security scan to the generated release PR checklist. ▪︎ Mentions security scan in the workflow summary next steps. ◦

.agents/skills/sdk-release/SKILL.md

▪︎ Documents

security-scan

alongside

integration-test

,

behavior-test

, and

test-examples

. ▪︎ Updates the release checklist from three checks to four. PR opened: • github.com/OpenHands/software-agent-sdk/pull/4069 • Branch:

add-security-scan-release-label

• Commit:

ea30350b702f65ee569c87865230efedf7a41d01

Validation / iteration: • Local:

git diff --check

passed. • PR CI: 33 passed, 0 failed, 0 pending, 3 skipped. • Unresolved review threads: 0. • Merge state: blocked only because the PR is still draft. I left the PR as draft because the repo template requires a human-authored

HUMAN

section before marking ready for review, and the template explicitly says AI agents must not edit that section. Once a human fills that section, the PR can be marked ready.

Opened the follow-up PR for the review feedback: • PR: github.com/OpenHands/software-agent-sdk/pull/4073 • Branch:

fix-security-scan-release-trigger

• Commit:

8383f680944feb3885d3ac1838b3d7a59bce0553

What it fixes: • Keeps current release branch naming:

rel-<version>

. • Updates

.github/workflows/security-scan.yml

from

startsWith(..., 'release/')

to

startsWith(..., 'rel-')

. • Updates the comments from

release/**

to

rel-*

. • Adds

opened

,

synchronize

, and

reopened

to the

pull_request

trigger, so the “always-on for release PRs” path actually runs without depending on the

security-scan

label event. Validation: •

git diff --check

passed. • PR CI passed: 33 passed, 0 failed, 0 pending, 4 skipped. • No unresolved review threads. I left it as draft again because the PR template requires a human-authored

HUMAN

section before ready-for-review.

Done — I narrowed PR #4073. Updated PR: • github.com/OpenHands/software-agent-sdk/pull/4073 • Head:

316d15a6f992617a6a78ac6a443aea9389c29af1

Now it only: • Changes the security-scan release branch guard from

release/

to

rel-

. • Updates nearby comments to say

rel-*

. • Keeps the existing labeled-only PR trigger:

types: [labeled]

. I also updated the PR body to remove the extra trigger expansion claim. Current status: • 32 checks passed • 0 failed • 1 pending:

build-binary-and-test (windows-latest)

• 2 skipped I stopped waiting on Windows per your note.