Seed new SDKs with GitHub's self-repository workflow references

Merged
JE
2mo ago
+27-5

zizmor 1.30.0 (what zizmor-action 0.6.3 runs by default) adds a self-repository audit that flags workspace-relative uses: ./... references to in-repo reusable workflows. The five release templates here call smithy-verify that way, so every SDK seeded from them would start out failing that audit the moment it adopted zizmor, as hey-sdk, basecamp-sdk and fizzy-sdk did. They now use the uses: $/... form GitHub recommends. GitHub's uses: $/... form is the syntax GitHub now recommends for same-repository references and the one zizmor's audit requires. For a job-level reusable-workflow call it changes nothing at runtime: ./ already resolves to the caller's commit, and reusable workflows are exempt from the org SHA-pinning policy, so the gain is conformance with the recommended form, not security.

Go templates only interpret {{ }}, so $/ passes through untouched. The seed's own test template runs neither zizmor nor actionlint, so no actionlint config is added here; a seeded repo that adopts actionlint 1.7.12 also needs the ignore that hey-sdk#174 carries, until an actionlint release knows the syntax (rhysd/actionlint#711).

Same change as basecamp/hey-sdk#171 and #174, basecamp-sdk#861 and fizzy-sdk#169.

Review follow-up: the templates called a reusable smithy-verify.yml the seed never shipped. This PR now carries seed/.github/workflows/smithy-verify.yml.tmpl, byte-identical to the one #11 adds, so a freshly seeded SDK's release workflows resolve, and the two PRs merge cleanly in either order.