DRIVERS-3596 Adopt GitHub Actions self-repository syntax for internal action references - #112
Conversation
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
…o zizmor 1.29.0 ($/ support)
|
Semgrep found 31
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. 🛟 Help? Slack #semgrep-help or go/semgrep-help. Resolution Options:
|
|
/fp this is a new feature of GitHub. The actions are pinned to the same sha as the calling action. |
There was a problem hiding this comment.
Pull request overview
This PR migrates internal action-to-action references within mongodb-labs/drivers-github-tools from pinned mongodb-labs/drivers-github-tools/<path>@v3 usage to GitHub Actions’ new $/<path> self-repository syntax, aiming to remove ongoing maintenance associated with keeping internal tag references current while preserving the external consumer interface.
Changes:
- Replaced internal composite-action
uses:references across multiple language publish/release actions from...@v3to$/.... - Updated docs (README/CONTRIBUTING) to document
$/usage, requirements, and the one exception (node/release_template.yml) that must remain pinned for downstream rendering. - Updated the zizmor workflow to a newer pinned zizmor-action revision and migrated
update-action-tag.ymlinternal local references to$/.
Reviewed changes
Copilot reviewed 20 out of 21 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tag-version/action.yml | Switches internal reference to git-sign from @v3 to $/git-sign. |
| bump-version/action.yml | Switches internal reference to git-sign from @v3 to $/git-sign. |
| full-report/action.yml | Migrates internal sub-action calls (authorized-pub, sbom, etc.) to $/ syntax. |
| create-branch/action.yml | Migrates internal reference to bump-version to $/bump-version. |
| ruby/publish/action.yml | Migrates internal action dependencies (secure-checkout, setup, gpg-sign, etc.) to $/. |
| ruby/cleanup/action.yml | Migrates internal secure-checkout reference to $/secure-checkout. |
| ruby/build/action.yml | Migrates internal secure-checkout reference to $/secure-checkout. |
| python/pre-publish/action.yml | Migrates internal references (bump-version, tag-version) to $/. |
| python/post-publish/action.yml | Migrates internal references (gpg-sign, full-report, upload-s3-assets, bump-version) to $/. |
| python-labs/pre-publish/action.yml | Migrates internal tag-version reference to $/tag-version. |
| python-labs/post-publish/action.yml | Migrates internal bump-version reference to $/bump-version. |
| golang/pre-publish/action.yml | Migrates internal references (bump-version, tag-version) to $/. |
| golang/publish/action.yml | Migrates internal references (full-report, upload-s3-assets) to $/. |
| node/sign_node_package/action.yml | Migrates internal references (node/get_version_info, setup, gpg-sign) to $/. |
| node/release_template.yml | Adds clarification comment explaining why this template must stay pinned (not $/). |
| node/generate_release.mjs | Strips the new explanatory template comment line during generation so consumers don’t receive it. |
| .github/workflows/update-action-tag.yml | Migrates workflow-local action references from ./... to $/.... |
| .github/workflows/zizmor.yml | Updates zizmor-action pin to a newer revision. |
| README.md | Documents $/ semantics, runner requirement, and consumer implications of internal dependency freezing. |
| CONTRIBUTING.md | Updates version-bump guidance to reflect that internal references no longer require bulk updates. |
| .gitignore | Ignores .superpowers/ and docs/superpowers/plans/. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
GromNaN
left a comment
GromNaN
left a comment
There was a problem hiding this comment.
Could you update the PR description to reflect the current state?
The changes LGTM; the side notes could be improved.
Summary
Migrates this repo's internal action-to-action references from pinned
mongodb-labs/drivers-github-tools/<path>@v3tags to GitHub Actions' new$/<path>self-repository syntax. This removes the recurring manual-retagging maintenance cost, without changing the public interface driver repos consume. Rollout was staged: a canary migration of one action was validated in real CI before migrating the rest, per DRIVERS-3596's acceptance criteria.node/release_template.ymlkeeps its pinned references, since it is a template rendered into driver repos rather than something that runs in this repo. Docs and the pinnedzizmor-actionversion were also updated as part of this change.Test plan
zizmorsecurity-scan CI job passes on the canary commit (requires zizmor >=1.29.0, which added$/support 2026-08-01; the job'szizmorcore/zizmor-actioninstallslatestby default)test.yml(pre-commit) CI job passes on the canary commitupdate-action-tag.yml's./setup/./git-signmigrated, externalv3tagging behavior unchangedpre-commit+zizmorclean on the whole repo