Repository navigation
Use self-repository syntax for in-repo action references - #1307
Closed
brunoborges wants to merge 2 commits into
Closed
brunoborges wants to merge 2 commits into
brunoborges wants to merge 2 commits into
Conversation
Replace workspace-relative `uses: ./` with the self-repository `uses: $/` syntax in the e2e workflows so the action under test always resolves to the running commit rather than runtime filesystem state, resolving the zizmor/self-repository code scanning alerts. The cache restore benchmark intentionally loads baseline and candidate actions from runtime checkouts of user-supplied refs, which `$/` cannot express, so those references are explicitly exempted. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the workflow action-reference updates.
No open issues 🎉
What changed in this PR
This PR updates setup-java’s CI workflows to use self-repository action references, resolving the action from the running commit rather than mutable workspace files.
Changes:
- Replaces 43
uses: ./references withuses: $/across five end-to-end workflows. - Preserves seven runtime-checkout references in the benchmark workflow, adding targeted zizmor suppressions and a comment explaining why they are necessary.
| File | Description |
|---|---|
.github/workflows/e2e-versions.yml |
Uses self-repository references for Java version and distribution tests. |
.github/workflows/e2e-smoke.yml |
Updates the smoke-test action reference. |
.github/workflows/e2e-publishing.yml |
Updates action references in publishing configuration tests. |
.github/workflows/e2e-local-file.yml |
Updates action references for local JDK installation tests. |
.github/workflows/e2e-cache.yml |
Updates action references throughout dependency-cache tests. |
.github/workflows/benchmark-cache-restore.yml |
Documents and suppresses audit warnings for intentional runtime-checkout references. |
Review effort: Balanced
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
brunoborges
marked this pull request as ready for review
October 30, 2026 16:58
Contributor
Author
|
Closing without merging. The self-repository |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
zizmor's
self-repositoryaudit flagged 50 workflow steps that reference this action with workspace-relativeuses: ./...(code scanning alerts #136-#186, e.g. #160). Workspace-relative references resolve against whatever is on disk at runtime, so an earlier step could swap in a different action. They also don't count as pinned under GitHub's "require full-length SHA" policy. The new self-repository syntax (uses: $/) always resolves to the repository at the running commit.uses: ./->uses: $/ine2e-cache.yml,e2e-local-file.yml,e2e-publishing.yml,e2e-smoke.yml, ande2e-versions.yml. None of these jobs check out another ref or build the action before using it, so they still test the same code.benchmark-cache-restore.yml(7 alerts): these steps intentionally load the action from runtime checkouts of the user-suppliedbaseline-ref/candidate-ref(./baseline,./candidate).$/can't express that, so those lines get inline# zizmor: ignore[self-repository]comments, with a short note at the top of the file explaining why.Things to watch:
$/requires runner 2.336.0 or newer and is not available on GHES. That's fine for these github.com CI workflows. A self-hosted runner would need checking..github/workflows/now reports no findings (7 intentionally ignored). The alerts close once zizmor runs onmain.Related issue:
N/A. Addresses zizmor
self-repositorycode scanning alerts #136-#186.Check list:
npm run checklocally (format, lint, build, test) and all checks pass.