Reference in-repo workflows with GitHub's self-repository syntax - #75
Reference in-repo workflows with GitHub's self-repository syntax#75jeremy wants to merge 1 commit into
Conversation
zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative `uses: ./...` references to in-repo actions and reusable workflows. GitHub's `uses: $/...` form resolves against the running commit rather than the checked-out filesystem, so it can't pick up an action cloned by an earlier step, and GitHub counts it as pinned. This repo pins zizmor-action 0.6.2 and would fail the audit on the next bump. The audit covers the whole checkout, so the seed template's release workflow is rewritten alongside our own: seeded repos inherit the same reference. actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so an actionlint config ignores that one message for workflow files, with a note to drop it once a release does. Same change as basecamp/hey-sdk#171 and #174.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Duplicate of #74, which already makes this exact change (same three files). Closing in favor of that one. |
There was a problem hiding this comment.
🟢 Approved
The syntax migration and narrowly scoped lint workaround are complete and consistent.
Pull request overview
Updates reusable workflows to GitHub’s pinned self-repository syntax while preserving actionlint compatibility.
Changes:
- Replaces workspace-relative workflow references with
$/.... - Adds a narrowly scoped actionlint suppression.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
.github/workflows/release.yml |
Uses self-repository syntax. |
seed/.github/workflows/release.yml |
Updates the generated release workflow. |
.github/actionlint.yaml |
Suppresses actionlint’s unsupported-syntax diagnostic. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Closing as a duplicate of #74, which makes the same change to the same three files and predates this. |
zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative
uses: ./...references to in-repo actions and reusable workflows. GitHub'suses: $/...form resolves against the running commit rather than the checked-out filesystem, so it can't pick up an action cloned by an earlier step, and GitHub counts it as pinned. This repo pins zizmor-action 0.6.2 and would fail the audit on the next bump. The audit covers the whole checkout, so the seed template's release workflow is rewritten alongside our own.actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so
.github/actionlint.yamlignores that one message for workflow files, with a note to drop it once a release does. Locally, zizmor 1.30.0 goes from 2 self-repository findings to none and actionlint exits 0; CI's GitHub Actions audit job on this PR is the proof.Same change as basecamp/hey-sdk#171 and #174.