Reference in-repo workflows with GitHub's self-repository syntax - #77
Reference in-repo workflows with GitHub's self-repository syntax#77jeremy wants to merge 1 commit into
Conversation
zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative `uses: ./...` references to in-repo actions and reusable workflows. GitHub's `uses: $/...` form resolves against the running commit rather than the checked-out filesystem, so it can't pick up an action cloned by an earlier step, and GitHub counts it as pinned. This repo pins zizmor-action 0.6.2 and would fail the audit on the next bump. The audit covers the whole checkout, so the seed template's release workflow is rewritten alongside our own: seeded repos inherit the same reference. actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so an actionlint config ignores that one message for workflow files, with a note to drop it once a release does. Same change as basecamp/hey-sdk#171 and #174.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b886f2045
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| security: | ||
| name: Security scan | ||
| uses: ./.github/workflows/security.yml | ||
| uses: $/.github/workflows/security.yml |
There was a problem hiding this comment.
When seed/ is staged as a standalone generated repository and actionlint 1.7.12 runs, this new $/ call is rejected because the commit adds the required ignore only at .github/actionlint.yaml; there is no seed/.github/actionlint.yaml, and the GitHub-infra copy list in prompts/seed-cli.md would not copy one anyway. Add the config to the seed and include it in that copy list so generated CLIs do not fail their Actions audit.
AGENTS.md reference: AGENTS.md:L47-L54
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
🟡 Changes recommended
The seed lacks the actionlint configuration and copy-map entry needed to accept its updated workflow.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adopts GitHub’s $/ self-repository syntax for reusable workflows while suppressing actionlint 1.7.12’s unsupported-syntax diagnostic.
Changes:
- Updates root and seed release workflows to use
$/. - Adds a scoped root actionlint ignore.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
.github/actionlint.yaml |
Suppresses the known actionlint diagnostic. |
.github/workflows/release.yml |
Uses self-repository workflow syntax. |
seed/.github/workflows/release.yml |
Applies the syntax to generated CLIs. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| security: | ||
| name: Security scan | ||
| uses: ./.github/workflows/security.yml | ||
| uses: $/.github/workflows/security.yml |
Dependabot's github-actions bump #73 fails the GitHub Actions audit. This lands the workflow change on
mainby itself so the bump can be recreated cleanly on top;mainis green today only because it still pins zizmor-action 0.6.2.Why the bump fails
zizmor-action's
versioninput defaults tolatest, resolved from a manifest bundled with the action: 0.6.2 resolves to zizmor 1.29.0, 0.6.3 to 1.30.0. zizmor 1.30.0 adds theself-repositoryaudit, which flags workspace-relativeuses: ./...calls to in-repo reusable workflows. #73's audit job (run) reports two low findings, exit 12:What changes
.github/workflows/release.ymlandseed/.github/workflows/release.yml:uses: ./.github/workflows/security.yml→uses: $/.github/workflows/security.yml. For a job-level reusable-workflow call this changes nothing at runtime —./already resolves to the caller's commit — so the gain is conformance with the form GitHub now recommends and the audit requires. zizmor has parsed$/since 1.29.0, so this is green onmainwith the action still at 0.6.2..github/actionlint.yamlandseed/.github/actionlint.yaml: actionlint 1.7.12 (still the latest release) predates the$/syntax and rejects it as malformed (rhysd/actionlint#711, open). The ignore names the exact call, so a new$/call is a deliberate config edit rather than a silent pass. The seed carries its own copy so a CLI rendered from it passes its own audit job the way hey-cli and fizzy-cli already do.Verified locally: actionlint 1.7.12 exits 0 at the root and on the seed staged as its own repo (1 without the config); zizmor 1.30.0,
--persona regular, online, over.reports no findings (19 ignored, 47 suppressed) where it reported the two above before.Follow-up
Once this merges, comment
@dependabot recreateon #73 so Dependabot regenerates the bump on top of it; the bump then passes the audit as-is.Same change as basecamp/hey-sdk#174, basecamp/basecamp-sdk#861, basecamp/fizzy-sdk#169 and basecamp/basecamp-cli#700.