From a2b48e9de95b3871e336ecab4119c8f7cc8fbcb1 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 10 Sep 2026 02:47:59 -0700 Subject: [PATCH 1/3] Reference in-repo workflows with GitHub's self-repository syntax zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative `uses: ./...` references to in-repo actions and reusable workflows. GitHub's `uses: $/...` form resolves against the running commit rather than the checked-out filesystem, so it can't pick up an action cloned by an earlier step, and GitHub counts it as pinned. This repo pins zizmor 1.29.0 explicitly (the action's `version:` input and .mise.toml) and would fail the audit as soon as that pin moves to 1.30.0. actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so an actionlint config ignores that one message for workflow files, with a note to drop it once a release does. Same change as basecamp/hey-sdk#171 and #174. --- .github/actionlint.yaml | 9 +++++++++ .github/workflows/release.yml | 4 ++-- 2 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 00000000..e285e3f2 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,9 @@ +# actionlint's rules for this repository. See https://github.com/rhysd/actionlint/blob/main/docs/config.md +paths: + .github/workflows/**/*.yml: + ignore: + # GitHub's self-repository `uses: $/...` syntax (July 2026) is what zizmor's + # self-repository audit asks for in place of `./...`, and what our reusable-workflow + # calls use. actionlint 1.7.12 predates it and has no release that knows it + # (rhysd/actionlint#711); drop this once one does. + - 'reusable workflow call "\$/.+" at "uses" is not following the format' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7fa82203..661c5654 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ permissions: {} jobs: security: name: Security scan - uses: ./.github/workflows/security.yml + uses: $/.github/workflows/security.yml permissions: contents: read security-events: write @@ -31,7 +31,7 @@ jobs: # actions/checkout inside the reusable workflow has no repository access. headless-probe: name: Headless keyring probe - uses: ./.github/workflows/headless-probe-composition.yml + uses: $/.github/workflows/headless-probe-composition.yml permissions: contents: read From c2d995ef2487690eba4bf982f030eaf13ba43554 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 10 Sep 2026 09:02:37 -0700 Subject: [PATCH 2/3] Scope the actionlint ignore to the calls it covers The ignore for actionlint 1.7.12's rejection of the `$/` reusable-workflow form now names the exact calls this repository makes, so a new `$/` call is a deliberate edit to the config rather than a silent pass. actionlint accepts `$/path@ref` as the owner/repo/path@ref shape with or without this ignore, so the scoping is about new sites, not malformed references. --- .github/actionlint.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index e285e3f2..b594dcbd 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -5,5 +5,6 @@ paths: # GitHub's self-repository `uses: $/...` syntax (July 2026) is what zizmor's # self-repository audit asks for in place of `./...`, and what our reusable-workflow # calls use. actionlint 1.7.12 predates it and has no release that knows it - # (rhysd/actionlint#711); drop this once one does. - - 'reusable workflow call "\$/.+" at "uses" is not following the format' + # (rhysd/actionlint#711); drop this once one does. The ignore names the exact calls, + # so a new `$/` call is a deliberate edit here rather than a silent pass. + - 'reusable workflow call "\$/\.github/workflows/(security|headless-probe-composition)\.yml" at "uses" is not following the format' From 792dd6566de787dd1c61adb0f7149824cf163799 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 10 Sep 2026 11:19:38 -0700 Subject: [PATCH 3/3] Move to zizmor-action 0.6.3 and zizmor 1.30.0 so CI runs the audit this fixes This repo pins zizmor explicitly through the action's version input and .mise.toml, so the Dependabot bump of the action alone (#698) would have left CI on 1.29.0 and the self-repository fix in the previous commit untested. Both pins move to 1.30.0 together with the action, whose version map at 0.6.2 does not know 1.30.0, so the audit job on this branch is the proof. --- .github/workflows/test.yml | 4 ++-- .mise.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8ad91f8b..98b2def3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -93,13 +93,13 @@ jobs: uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 - name: Run zizmor - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3 with: # The action resolves `version` (default "latest") through the digest # map checked in at its pinned SHA, so this stays stable either way — # the explicit pin keeps the release from shifting when the action SHA # is bumped, and matches the .mise.toml zizmor pin for local parity. - version: "1.29.0" + version: "1.30.0" advanced-security: false security: diff --git a/.mise.toml b/.mise.toml index b8f1e97e..f1ac9ee0 100644 --- a/.mise.toml +++ b/.mise.toml @@ -12,4 +12,4 @@ shellcheck = "0.11.0" powershell = "7.6.5" # Keep in sync with the zizmor-action `version:` input in # .github/workflows/test.yml so local bin/ci runs the same release CI does. -zizmor = "1.29.0" +zizmor = "1.30.0"