ci: drop the zizmor self-repository ignores and take the auto-fix once actionlint understands `$/`

[kyle-sexton]

Tracking the revisit condition left behind by the zizmor 1.30.0 bump (#4021), so it does not depend on someone happening to read the comment in ci.yml.

Current state

zizmor 1.30 added the self-repository audit, which recommends GitHub's $/... reference form over the workspace-relative ./... form. It fires on every uses: ./.github/actions/checkout-with-base call site, and the lint lane treats any zizmor finding as a failure, so the bump could not land without addressing it.

The audit's advice could not be taken. Its auto-fix rewrites the call sites to $/.github/actions/checkout-with-base, and actionlint then rejects every one of them, so the lane goes red in a different step instead. Each site therefore carries a terse # zizmor: ignore[self-repository], with the reasoning recorded once above the Run zizmor step in .github/workflows/ci.yml.

Current suppression sites (7):

File	Count
.github/workflows/ci.yml	4
.github/workflows/claude-security-review.yml	1
.github/workflows/dependabot-miro-bundle.yml	1
.github/workflows/silent-revert-canary.yml	1

Why it is still blocked

$/ is genuinely supported by GitHub Actions (changelog, 2026-07-21); a uses: value starting with $/ resolves to the workflow's own repository at the running commit, requires runner 2.336.0 or newer, and works everywhere ./ works. The blocker is the linter, not the platform.

actionlint does not yet parse it. Taking the auto-fix against current main produces 7 errors and exit 1:

.github/workflows/ci.yml:145:15: specifying action "$/.github/actions/checkout-with-base" in invalid format
because ref is missing. available formats are "{owner}/{repo}@{ref}" or "{owner}/{repo}/{path}@{ref}" [action]

actionlint v1.7.12 (released 2026-03-30) is the latest release, and no release note through v1.7.12 mentions $/ or self-repository syntax. actionlint reaches this repository through a SHA-pinned external action, so it cannot be moved from here:

uses: melodic-software/ci-workflows/.github/actions/actionlint@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2

Trigger condition

An actionlint release parses uses: $/... without the "invalid format because ref is missing" error, and the melodic-software/ci-workflows actionlint action is repinned to a version carrying it.

Steps when the condition is met

1. Confirm the new actionlint accepts $/, ideally by running it over these four workflow files directly.
2. Repin the melodic-software/ci-workflows/.github/actions/actionlint SHA in ci.yml to the release carrying it.
3. Run zizmor --fix=safe --persona=regular -- . to rewrite the 7 call sites, or edit them by hand.
4. Delete the 7 # zizmor: ignore[self-repository] comments and the explanatory block above the Run zizmor step in ci.yml, which exists only to justify them.
5. Verify both linters are clean: zizmor exit 0 with no findings and no self-repository ignores counted, and actionlint exit 0.

Notes

• Nothing here is urgent. The suppressions are narrowly scoped to one audit at one call-site shape and leave zizmor's other audits active; the self-repository finding is severity Low.
• Do not reach for a repo-wide zizmor.yml disable: true instead. zizmor's own documentation calls disabling an audit a last resort, and it would hide the finding on future call sites too.
• Adopting $/ is a small improvement beyond silencing the audit: it removes the ordering subtlety that dependabot-miro-bundle.yml documents, where the merge commit must be checked out before the composite action can resolve.

[kyle-sexton]

Two notes so nothing lives only in the session that filed this.

Optional tidy-up, independent of the trigger condition. The explanatory comment above the Run zizmor step in ci.yml does not cite this issue, so the link is one-way: this issue points at the code, the code does not point back. Adding (#4130) to that comment block would close the loop. It is a one-line change needing a full PR cycle against a protected branch, which is why it was not bundled into #4021; fold it into whatever next PR already touches ci.yml rather than spending a cycle on it alone.

The $/ rewrite is available early if someone wants it. It is mechanically ready now: zizmor --fix=safe --persona=regular -- . rewrites all 7 sites cleanly, and the only thing stopping it is actionlint. Taking it before the trigger condition is met means accepting a red lint lane, so it should not be done casually, but it is a deliberate choice someone could make rather than a blocked path. Re-measured against main at 17b914a1: 7 self-repository findings suppressed and zizmor exit 0 as shipped; with the fix applied, zizmor reaches exit 0 with no suppressions and actionlint goes to 7 errors and exit 1.

---

Generated by Claude Code