From 069bae0b28226d1c6db05fe70e5030661dfd1b09 Mon Sep 17 00:00:00 2001 From: David McKay Date: Tue, 1 Sep 2026 13:08:56 -0700 Subject: [PATCH] Reference the release checks by the repository's own syntax `uses: ./.github/workflows/ci.yml` and `uses: $/.github/workflows/ci.yml` both call the reusable CI workflow from the caller's own commit, but only the second says so. The relative form is the same spelling a path on disk would take, and GitHub resolves it against the repository rather than the checkout, which is a difference nothing in the file makes visible. zizmor 0.6.3 added the audit that flags this (`self-repository`, low, with an auto-fix), so the dependency bump in #300 fails on it until this lands. --- .github/workflows/publish-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index f3cddb5c2..4d079c0b5 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -100,7 +100,7 @@ jobs: checks: needs: [metadata, verify] if: needs.metadata.outputs.is_release == 'true' - uses: ./.github/workflows/ci.yml + uses: $/.github/workflows/ci.yml permissions: contents: read