Reference in-repo workflows with GitHub's self-repository syntax - #430
Reference in-repo workflows with GitHub's self-repository syntax#430jeremy wants to merge 1 commit into
Conversation
zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative `uses: ./...` references to in-repo actions and reusable workflows. GitHub's `uses: $/...` form resolves against the running commit rather than the checked-out filesystem, so it can't pick up an action cloned by an earlier step, and GitHub counts it as pinned. This repo pins zizmor-action 0.6.2 and would fail the audit on the next bump. actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so an actionlint config ignores that one message for workflow files, with a note to drop it once a release does. Same change as basecamp/hey-sdk#171 and #174.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approved
The changes are narrowly scoped, documented, and validated by the successful GitHub Actions audit.
Pull request overview
Updates reusable workflow references to GitHub’s secure self-repository syntax and accommodates actionlint 1.7.12.
Changes:
- Uses
$/...for the release security workflow. - Adds a narrowly scoped temporary actionlint exception.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
.github/workflows/release.yml |
Uses self-repository workflow resolution. |
.github/actionlint.yaml |
Suppresses actionlint’s unsupported-syntax error. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Closing: #421 now carries this change. It was reworked from the inline zizmor ignore onto the |
zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative
uses: ./...references to in-repo actions and reusable workflows. GitHub'suses: $/...form resolves against the running commit rather than the checked-out filesystem, so it can't pick up an action cloned by an earlier step, and GitHub counts it as pinned. This repo pins zizmor-action 0.6.2 and would fail the audit on the next Dependabot bump, sorelease.yml's call to thesecurity.ymlreusable workflow moves to the new form.actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so
.github/actionlint.yamlignores that one message for workflow files, with a note to drop it once a release does.CI's audit job on this PR (actionlint, then zizmor) is the proof.
Same change as basecamp/hey-sdk#171 and #174.
Summary by cubic
Changes the release workflow's in-repo reusable workflow call to GitHub's self-repository syntax (
uses: $/...). This complies with zizmor 1.30.0's self-repository audit, which flags workspace-relative./references, and GitHub counts$/...as pinned. The new form resolves against the running commit rather than the checked-out filesystem. Also adds.github/actionlint.yamlto ignore actionlint's current rejection of the new syntax until it's supported.Written for commit a00fe32. Summary will update on new commits.