Adopt GitHub's self-repository uses syntax, or disposition the 84 open zizmor self-repository alerts

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

zizmor 1.30.0 added the self-repository audit, and since 2026-09-07 it reports 84 open code-scanning alerts
in this repository: 76 in .github/workflows/ci.yaml, 2 in active-release.yaml, and one each in
dependency-review.yaml, lint.yaml, run-dotnet-tests.yaml, scan-for-todo-comments.yaml,
update-agent-skills.yaml and validate-go-project.yaml. None has been fixed or dismissed. Every new uses: ./…
line adds another, and each one opens a review thread that has to be resolved by hand before merge (for example on
devantler-tech/actions#1232).

zizmor's documentation for the audit says GitHub now supports a self-repository form, uses: $/<path>, for in-repo
actions and reusable workflows.

Why it matters here

• The documented benefit is security: unlike ./…, the $/ form does not depend on the runner's filesystem, so it
  cannot load an action cloned there by an earlier step, and GitHub treats it as pinned for policy enforcement.
• That second point is what Revert tag-pin accommodations now that self-references are SHA-pinned actions#426 is waiting on (re-enabling sha_pinning_required for this repository).
• The reusable workflows use a same-commit self-checkout into .devantler-tech-actions precisely because ./…
  resolves against the caller's workspace. If $/ resolves against the workflow's own repository and commit, that
  pattern and its cleanup step may become unnecessary.

Expected outcome

Either adopt $/ for in-repo references, or record why this repository keeps ./… and stop the alerts from
accumulating.

Acceptance criteria

• Verify on a test job that $/<action> resolves to the same commit as the calling workflow, for a local job, a
  reusable workflow called from ci.yaml, and a reusable workflow called from another repository.
• If it holds, migrate every flagged reference, update the self-reference rules in AGENTS.md, and keep the CI
  coverage-parity guard (it matches uses: ./<action>) working with the new form.
• If it does not hold for some case, record which and why, and disposition those alerts with that reason.
• Zero open self-repository alerts afterwards.

Rough size: M (the change is mechanical; proving resolution semantics per case is the real work).

[devantler]

🤖 Generated by the Agentic Engineer

Measured while resolving these alerts on a new ksail workflow (ksail#7130): the "adopt" option is not currently available where MegaLinter runs the lint.

actionlint v1.7.12, which MegaLinter v10.1.0 pins, does not recognise the syntax and rejects it as a malformed reference:

.github/workflows/codeql.yaml:91:15: specifying action "$/.github/actions/free-disk-space" in invalid format
because ref is missing. available formats are "{owner}/{repo}@{ref}" or "{owner}/{repo}/{path}@{ref}" [action]

Reproduced locally on actionlint v1.7.9 with the same ignore flags CI passes, and confirmed in the other direction: the ./ form exits 0, the $/ form exits 1 with that exact message. So adopting the syntax today trades a zizmor low finding for a red required lint — strictly worse.

That leaves the second option, disposition, as the only one currently open. On ksail#7130 I suppressed it on exactly the two lines it fires on, with the reason recorded inline:

uses: ./.github/actions/free-disk-space # zizmor: ignore[self-repository]

Two things worth knowing for whoever picks this up:

• The rule is self-repository, not unpinned-uses. The code-scanning annotation renders with an empty rule id, so the name is not visible from the PR check — I suppressed the wrong rule first and zizmor silently kept reporting.
• The ignore comment must sit on the uses: line itself, not on a preceding line. Placed above, it is accepted without complaint and suppresses nothing.

Suggested sequencing: disposition now, and gate adoption on MegaLinter shipping an actionlint release that understands the syntax — at which point the migration is mechanical and this issue can close by doing the first option properly.

[devantler]

🤖 Generated with Claude Code in an interactive session with the maintainer.

New evidence (2026-09-25): sha_pinning_required accepts $/. platform enforces SHA pinning, so a throwaway branch there ran two probe workflows. A uses: $/.github/actions/<local> step ran, resolved to the running commit's full SHA. A control step using actions/checkout@v6 was refused at job setup. Details on #121. That removes one unknown from this issue. The cross-repository resolution check and the actionlint rejection above both still stand.

This issue moves to devantler-tech/.github with the rest of the catalogue (#236). The import (#243) carries 10 of these alerts over; their review threads point here.