ci: convert self-references to self-repository syntax - #16
Open
arcuru-bot wants to merge 4 commits into
Open
Conversation
actionlint rejects any runner label it does not recognise, and the consumer repositories this repo serves run on ubicloud rather than hosted runners. The label list has to exist here before a workflow in this repo can name one. Assisted-by: Claude Opus 5 <noreply@anthropic.com>
`$/<path>` resolves to the running workflow's own repository at the exact commit being run, and needs runner agent 2.336.0 or newer. Hosted runners follow GitHub's own release schedule; ubicloud builds its own images and refreshes them monthly after the fact, so hosted support does not imply ubicloud support — and every consumer of this repository runs on ubicloud. Both are probed, x64 and arm64 separately, since they are separate images. The probe asserts on a marker propagated out of a nested reference rather than on the step merely succeeding: a reference that resolves to nothing would otherwise read as a pass, and nested composition is precisely the shape the conversion depends on. It also checks out nothing, so a `$/` that secretly required a workspace would fail here. actionlint cannot parse `$/` and rejects the file wholesale, so ci.yml excludes it by name. That is the entire available remedy — the rejection happens during parsing, before `-ignore` could filter anything — and it is why this must not reach main yet: zizmor cannot parse it either, and unlike actionlint it audits the tree as a whole and aborts, taking the daily security audit with it. Assisted-by: Claude Opus 5 <noreply@anthropic.com>
This repository's workflows reached its own composite actions absolutely, pinned to a SHA on main, because a reusable workflow's steps execute against the caller's workspace and a relative path cannot reach them. That made the version a consumer pinned and the action version it actually ran two separate facts held together by hand: a caller on v0.2.1 ran whichever setup-nix commit happened to be hardcoded inside v0.2.1. `$/` makes them one fact — it resolves to the repository being run, at the commit being run. Most of this diff is removal. The updater no longer needs to leave these references alone lest bumping one manufacture the drift the next run finds; the audit no longer needs to compare action content against the tree to answer a question the syntax now answers; and the ref-version-mismatch suppression covering six whole files goes, which un-masks the third-party pins those entries had been suppressing as collateral. scan-pins learns `$/` as a first-class reference with `ref_kind: self`, exempt from every upstream check but still scanned and counted. Emitting nothing would be the more obvious change and the wrong one: verify-pins reports a reference that disappears, so a silently-dropped `$/` is exactly how a change swapping it back for a mutable `@main` would pass. Reverting one locally still reports it as unpinned, which is the property worth having. DO NOT MERGE YET. zizmor cannot parse `$/` through v1.28.0 — it aborts with "no audit was performed" for the whole tree, while building the model and so beyond the reach of any ignore rule, which would take the zizmor half of the daily security audit with it. actionlint rejects it too, so CI is red on this branch by design: suppressing it would mean excluding six of twelve workflows from linting, which is a worse trade than waiting. The probe commit answers the runner-support question in the meantime; this waits on the linters. Assisted-by: Claude Opus 5 <noreply@anthropic.com>
zizmor 1.29.0 parses `$/` self-references, so the audit bumps off the 1.28.0 that aborted on them (1.30.0 is still prerelease-only). actionlint 1.7.12 still rejects the syntax, so ci.yml stops excluding the probe workflow and lints every workflow with a scoped `-ignore` that suppresses only the `$/` parse error; a genuinely malformed `uses:` value is still caught. Drop the now-false "excluded from actionlint" note in the probe workflow and the README "Blocked" callout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converts this repository's self-references from SHA-pinned absolute
arcuru/actions/.github/actions/...@<sha>uses:values to GitHub's$/self-repository syntax, which resolves to the repository being run at the exact
commit being run. A reusable workflow's steps execute against the caller's
workspace, so a relative
./path could never reach these actions; before thischange the version a consumer pinned and the action version it actually ran
were two facts kept aligned by hand.
$/makes them the same fact, and retiresthe updater/audit bookkeeping that grew around the old arrangement.
The two linter blockers that originally parked this branch are now resolved:
$/as of v1.29.0 (2026-08-01);actions-audit.ymlnowpins
1.29.0. (1.30.0 is still prerelease-only —1.30.0-rc1— so it is notused.)
$/, soci.ymllints every workflowin one pass with a scoped
-ignorethat suppresses only the$/parse errorwhile still flagging a genuinely malformed
uses:value.Workflows in this diff (go live on merge)
This PR touches
.github/workflows/and.github/actions/**/action.yml;merging it is the moment they go live:
.github/workflows/actions-audit.yml.github/workflows/actions-update.yml.github/workflows/cargo-update.yml.github/workflows/ci.yml.github/workflows/flake-update.yml.github/workflows/security-audit.yml.github/workflows/self-syntax-probe.yml.github/workflows/update-hold.yml.github/actions/self-syntax-probe/action.yml.github/actions/self-syntax-probe/nested/action.ymlNot verified: ubicloud support
The
self-syntax-probeworkflow has not been run. It cannot run from thisfork: its job is gated
if: github.repository_owner == 'arcuru', and theubicloud runner labels (
ubicloud-standard-2,ubicloud-standard-2-arm) existonly for the
arcuruowner, so a fork run would queue forever. It will onlyexercise once this branch/workflow is on
arcuru/actions— by pushing thebranch there, or by merging this PR.
$/requires runner agent 2.336.0 or newer. Hosted runners get that onGitHub's schedule, but ubicloud ships its own images and refreshes them monthly
after the fact, so hosted support says nothing about ubicloud support — and
every consumer of this repository runs on ubicloud. That is the one unproven
assumption here, and whether to merge ahead of confirming ubicloud support is
the call to make.