Adopt self-repository workflow references

[jeremy]

Adopt GitHub's $/ self-repository syntax for the reusable-workflow calls in .github/workflows/release.yml and seed/.github/workflows/release.yml.

zizmor 1.30.0 (released 2026-08-30) added a self-repository audit that flags the ./.github/workflows/security.yml form, and zizmorcore/zizmor-action floats version: latest, so the GitHub Actions audit job already fails on main for any run after that date — it is what turns #73 red, independent of the bump there. Same adaptation fizzy-cli made in basecamp/fizzy-cli#210: switch to $/, and add .github/actionlint.yaml ignoring actionlint 1.7.12's not-yet-updated workflow-call format check for this one call (rhysd/actionlint#711, fix in rhysd/actionlint#732; fizzy-cli tracks removing the suppression in basecamp/fizzy-cli#211).

Two things to know about $/:

• Scorecard does not recognise it yet (ossf/scorecard#5191) and will raise a Pinned-Dependencies alert on the changed line, as it did on fizzy-cli; that is a false positive to dismiss with the same reasoning.
• The release workflow only runs on tags, so the reference is exercised at the next release rather than by this PR's checks — the same exposure fizzy-cli accepted.

Not done:

• No actionlint.yaml in seed/ — the seed's workflows and Makefile do not run actionlint, so it would configure a tool the seeded repo does not have.
• The first commit pinned the go install govulncheck@latest / benchstat@latest lines to clear Scorecard #17, #18, #19; review pointed out that the seed documents @latest as intentional (pinning delays scanner improvements and new-Go support for no reproducibility gain — the vulnerability database is fetched live either way, and the sibling repos that pinned have rotted at v1.1.4). The second commit reverts those pins and the three alerts are dismissed as won't-fix citing that policy.

make check and make lint-actions (actionlint + zizmor 1.30.0) pass locally. After this merges, @dependabot rebase on #73 turns it green.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T18:55:51.311507Z	ea79e21	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/release.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

🟡 Changes recommended

The lint suppression is overly broad, and generated workflows retain unpinned tool installations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins CI tools for reproducibility and adopts GitHub’s self-repository workflow syntax.

Changes:

• Pins govulncheck and benchstat versions.
• Uses $/ for reusable security workflows.
• Adds a temporary actionlint suppression.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
.github/actionlint.yaml	Suppresses unsupported $/ diagnostics.
.github/workflows/release.yml	Pins govulncheck and adopts $/.
.github/workflows/test.yml	Pins govulncheck and benchstat.
seed/.github/workflows/release.yml	Adopts $/ in generated releases.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.