Adopt self-repository workflow references

[jeremy]

Adopt GitHub's $/ self-repository syntax for the reusable-workflow calls in .github/workflows/release.yml and seed/.github/workflows/release.yml.

zizmor 1.30.0 (released 2026-08-30) added a self-repository audit that flags the ./.github/workflows/security.yml form, and zizmorcore/zizmor-action floats version: latest, so the GitHub Actions audit job already fails on main for any run after that date — it is what turns #73 red, independent of the bump there. Same adaptation fizzy-cli made in basecamp/fizzy-cli#210: switch to $/, and add .github/actionlint.yaml ignoring actionlint 1.7.12's not-yet-updated workflow-call format check for this one call (rhysd/actionlint#711, fix in rhysd/actionlint#732; fizzy-cli tracks removing the suppression in basecamp/fizzy-cli#211).

Two things to know about $/:

• Scorecard does not recognise it yet (ossf/scorecard#5191) and will raise a Pinned-Dependencies alert on the changed line, as it did on fizzy-cli; that is a false positive to dismiss with the same reasoning.
• The release workflow only runs on tags, so the reference is exercised at the next release rather than by this PR's checks — the same exposure fizzy-cli accepted.

Not done:

• No actionlint.yaml in seed/ — the seed's workflows and Makefile do not run actionlint, so it would configure a tool the seeded repo does not have.
• The first commit pinned the go install govulncheck@latest / benchstat@latest lines to clear Scorecard #17, #18, #19; review pointed out that the seed documents @latest as intentional (pinning delays scanner improvements and new-Go support for no reproducibility gain — the vulnerability database is fetched live either way, and the sibling repos that pinned have rotted at v1.1.4). The second commit reverts those pins and the three alerts are dismissed as won't-fix citing that policy.

make check and make lint-actions (actionlint + zizmor 1.30.0) pass locally. After this merges, @dependabot rebase on #73 turns it green.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T22:55:30.596614Z	22b0335	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/release.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

🟡 Changes recommended

The lint suppression is overly broad, and generated workflows retain unpinned tool installations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins CI tools for reproducibility and adopts GitHub’s self-repository workflow syntax.

Changes:

• Pins govulncheck and benchstat versions.
• Uses $/ for reusable security workflows.
• Adds a temporary actionlint suppression.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
.github/actionlint.yaml	Suppresses unsupported $/ diagnostics.
.github/workflows/release.yml	Pins govulncheck and adopts $/.
.github/workflows/test.yml	Pins govulncheck and benchstat.
seed/.github/workflows/release.yml	Adopts $/ in generated releases.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

Good catch, and it changes the PR. The seed's comment (# @latest intentional — pinning delays scanning improvements and new Go version support for no meaningful reproducibility gain) is this repo's documented policy from #3, and the evidence backs it: govulncheck fetches its vulnerability database live regardless of the binary version, and the sibling repos that did pin have rotted (hey-sdk and fizzy-sdk sit on govulncheck v1.1.4 against a current v1.8.0). Pinning here while the seed says the opposite would be inconsistency for Scorecard's benefit. So eae7766 drops the pins from this repo's workflows rather than propagating them into the seed; the three Scorecard Pinned-Dependencies alerts are dismissed as won't-fix citing that policy, and the PR is retitled to what is left: the $/ self-repository change.