From 8b886f2045fce4d1796a2474569d681ac1e5d23b Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremydaer@gmail.com>
Date: Thu, 10 Sep 2026 02:48:27 -0700
Subject: [PATCH] Reference in-repo workflows with GitHub's self-repository
 syntax

zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a
self-repository audit that flags workspace-relative `uses: ./...` references
to in-repo actions and reusable workflows. GitHub's `uses: $/...` form resolves
against the running commit rather than the checked-out filesystem, so it can't
pick up an action cloned by an earlier step, and GitHub counts it as pinned.
This repo pins zizmor-action 0.6.2 and would fail the audit on the next bump.

The audit covers the whole checkout, so the seed template's release workflow
is rewritten alongside our own: seeded repos inherit the same reference.

actionlint 1.7.12 rejects the new form and no release knows it yet
(rhysd/actionlint#711), so an actionlint config ignores that one message for
workflow files, with a note to drop it once a release does.

Same change as basecamp/hey-sdk#171 and #174.
---
 .github/actionlint.yaml            | 9 +++++++++
 .github/workflows/release.yml      | 2 +-
 seed/.github/workflows/release.yml | 2 +-
 3 files changed, 11 insertions(+), 2 deletions(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..e285e3f
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,9 @@
+# actionlint's rules for this repository. See https://github.com/rhysd/actionlint/blob/main/docs/config.md
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # GitHub's self-repository `uses: $/...` syntax (July 2026) is what zizmor's
+      # self-repository audit asks for in place of `./...`, and what our reusable-workflow
+      # calls use. actionlint 1.7.12 predates it and has no release that knows it
+      # (rhysd/actionlint#711); drop this once one does.
+      - 'reusable workflow call "\$/.+" at "uses" is not following the format'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 802bee8..ddd29e5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   security:
     name: Security
-    uses: ./.github/workflows/security.yml
+    uses: $/.github/workflows/security.yml
     permissions:
       contents: read
       security-events: write
diff --git a/seed/.github/workflows/release.yml b/seed/.github/workflows/release.yml
index 70f1c1e..12e4ca4 100644
--- a/seed/.github/workflows/release.yml
+++ b/seed/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   security:
     name: Security scan
-    uses: ./.github/workflows/security.yml
+    uses: $/.github/workflows/security.yml
     permissions:
       contents: read
       security-events: write