From 6145d0fb26ce8cb9aeef2375741edfc232f606db Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Mon, 31 Aug 2026 14:38:15 -0700 Subject: [PATCH] Use GitHub's self-repository uses: syntax in ci.yml Resolves the three zizmor/self-repository code scanning findings (https://github.com/rubyatscale/rubyfmt-action/security/code-scanning/1,2,3) by switching 'uses: ./' to 'uses: $/' for the three composite-action references in this repo's own test jobs, per: https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/ actionlint (rhysd/actionlint#711) doesn't understand this syntax yet, so its step now ignores that specific known-false-positive message. --- .github/workflows/ci.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9b36820..6fc1694 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,11 @@ jobs: shell: bash - name: actionlint - run: ./actionlint -color + # actionlint doesn't yet understand GitHub's "$/..." self-repository + # `uses:` syntax (https://github.com/rhysd/actionlint/issues/711), + # which we use below to resolve zizmor's self-repository findings. + # Remove this -ignore once actionlint adds support. + run: ./actionlint -color -ignore 'specifying action "\$/" in invalid format' shell: bash test-formatted: @@ -39,7 +43,7 @@ jobs: persist-credentials: false - name: Run rubyfmt-action against a formatted fixture (expect success) - uses: ./ + uses: $/ with: paths: test/fixtures/formatted.rb @@ -54,7 +58,7 @@ jobs: - name: Run rubyfmt-action against an unformatted fixture (expect failure) id: rubyfmt continue-on-error: true - uses: ./ + uses: $/ with: paths: test/fixtures/unformatted.rb @@ -75,6 +79,6 @@ jobs: persist-credentials: false - name: Run rubyfmt-action against a formatted fixture (expect success) - uses: ./ + uses: $/ with: paths: test/fixtures/formatted.rb