Reference in-repo workflows with GitHub's self-repository syntax
zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative uses: ./... references to in-repo actions and reusable workflows. This rewrites the six smithy-verify.yml calls to GitHub's uses: $/... form. GitHub's uses: $/... form is the syntax GitHub now recommends for same-repository references and the one zizmor's audit requires. For a job-level reusable-workflow call it changes nothing at runtime: ./ already resolves to the caller's commit, and reusable workflows are exempt from the org SHA-pinning policy, so the gain is conformance with the recommended form, not security. This repo pins zizmor-action 0.6.2 and would fail the audit on the next Dependabot bump.
actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so .github/actionlint.yaml gains a paths entry ignoring that one message for workflow files, with a note to drop it once a release does.
CI's audit job on this PR (actionlint + zizmor) is the proof.
Same change as basecamp/hey-sdk#171 and #174.
Summary by cubic
Switches all seven smithy-verify.yml calls from workspace-relative uses: ./... to GitHub's self-repository uses: $/... form. The new form resolves against the running commit and counts as pinned, so zizmor's self-repository audit won't fail on the next Dependabot bump.
Actionlint workaround
- actionlint 1.7.12 predates
$/..., so.github/actionlint.yamlignores that message, scoped to the exact calls so new$/calls require a deliberate config edit. - Drop the ignore once an actionlint release supports the syntax (rhysd/actionlint#711).