From 926da10ea7e4c0f076313aaebb6c97273b1d7941 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 06:24:02 -0500
Subject: [PATCH 01/18] Ignore .superpowers/ scratch workspace

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7a95436
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.superpowers/

From 53c638d41dbf331f254e58f89a61bac17bf462d2 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 06:24:27 -0500
Subject: [PATCH 02/18] DRIVERS-3596 Add implementation plan for $/
 self-repository syntax migration

---
 ...026-08-03-adopt-self-repo-action-syntax.md | 508 ++++++++++++++++++
 1 file changed, 508 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md

diff --git a/docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md b/docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md
new file mode 100644
index 0000000..ddc139b
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md
@@ -0,0 +1,508 @@
+# Adopt GitHub Actions Self-Repository Syntax Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Replace this repo's 37 internal `mongodb-labs/drivers-github-tools/<path>@v3` self-references (plus 2 `./`-relative references in `update-action-tag.yml`) with GitHub Actions' new `$/<path>` self-repository syntax, eliminating the recurring manual-retagging maintenance burden — without changing behavior for external consumers.
+
+**Architecture:** This is a mechanical YAML edit across 20 action/workflow files plus two doc updates. There is no application code and no unit-test suite here — correctness is verified via `pre-commit` (`check-github-actions` JSON-schema validation of `action.yml` files) and `zizmor` (GitHub Actions security static analysis, run both locally via `uvx` and in the repo's `.github/workflows/zizmor.yml` CI job). The rollout is staged: migrate one self-contained action first, push it, and confirm CI is green before migrating the rest, per the ticket's explicit acceptance criterion.
+
+**Tech Stack:** GitHub Actions (composite actions + reusable workflow YAML), `pre-commit`, `zizmor` (via `uvx zizmor`).
+
+**Ticket:** [DRIVERS-3596](https://jira.mongodb.org/browse/DRIVERS-3596)
+
+## Global Constraints
+
+- Every `$/<path>` reference must NOT include an `@{ref}` suffix — GitHub rejects `$/<path>@ref` as malformed. (Confirmed via `actions/runner#4457` and by testing: zizmor <1.29.0 errors with `malformed uses ref: missing @<ref>`.)
+- `$/` requires GitHub Actions runner ≥ 2.336.0 (shipped 2026-07-20). This repo has no self-hosted runners (`grep -rn "runs-on:" .github/workflows/*.yml` — all `ubuntu-latest`), so GitHub-hosted runners satisfy this automatically; there is nothing to configure.
+- The repo's zizmor CI job (`.github/workflows/zizmor.yml`) runs `zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0` with its `version` input left at the action's default of `"latest"` — this means CI will always fetch a zizmor build that understands `$/` (support landed in zizmor v1.29.0, 2026-08-01; verified locally that v1.28.0 fatally errors on `$/` refs but v1.29.0 parses them cleanly with zero new findings). No CI config change is required for this, but the canary step (Task 1) re-confirms it against the real CI environment, not just local `uvx`.
+- Keep `update-action-tag.yml` retagging `v3` for external consumers unchanged (AC4) — this migration only touches how actions reference each other *internally*; it does not change the public `owner/repo/path@v3` interface that driver repos consume.
+- No behavior change for any external consumer of these actions.
+
+---
+
+## File Structure
+
+No new files are created. Files modified:
+
+- `tag-version/action.yml` — canary migration (Task 1)
+- `bump-version/action.yml`, `create-branch/action.yml`, `full-report/action.yml` — root-level actions (Task 2)
+- `golang/pre-publish/action.yml`, `golang/publish/action.yml` (Task 3)
+- `node/release_template.yml`, `node/sign_node_package/action.yml` (Task 4)
+- `python/pre-publish/action.yml`, `python/post-publish/action.yml`, `python-labs/pre-publish/action.yml`, `python-labs/post-publish/action.yml` (Task 5)
+- `ruby/build/action.yml`, `ruby/cleanup/action.yml`, `ruby/publish/action.yml` (Task 6)
+- `.github/workflows/update-action-tag.yml` (Task 7)
+- `README.md`, `CONTRIBUTING.md` (Task 8)
+
+Every task's substitution follows the same rule: a `uses:` line matching `mongodb-labs/drivers-github-tools/<PATH>@v3` becomes `uses: $/<PATH>` (same leading whitespace and any `- ` step-list prefix preserved, only the value changes).
+
+---
+
+### Task 1: Canary migration — `tag-version/action.yml`
+
+**Files:**
+- Modify: `tag-version/action.yml:36`
+
+**Interfaces:** None — this is a leaf composite-action reference change with no signature implications for other tasks.
+
+- [ ] **Step 1: Make the change**
+
+```bash
+sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' tag-version/action.yml
+rm tag-version/action.yml.bak
+```
+
+Confirm the only change is line 36 becoming:
+```yaml
+      uses: $/git-sign
+```
+
+- [ ] **Step 2: Validate schema locally**
+
+Run: `pre-commit run check-github-actions --files tag-version/action.yml`
+Expected: `Passed`
+
+- [ ] **Step 3: Validate security lint locally**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml tag-version/action.yml`
+Expected: exits non-zero only due to pre-existing `template-injection`/`github-env` findings already present in this file before this change (verify by comparing against `uvx zizmor@1.29.0 --config .github/zizmor.yml .` run against the pre-migration `main` branch — the finding count and lines for `tag-version/action.yml` must be identical). There must be **no** finding referencing `$/git-sign`, and no parse/model error.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add tag-version/action.yml
+git commit -m "DRIVERS-3596 Migrate tag-version to \$/ self-repository syntax (canary)"
+```
+
+- [ ] **Step 5: Push and validate in real CI before continuing**
+
+This step requires the user's explicit go-ahead to push (per repo safety rules — pushing branches and opening PRs needs confirmation each time).
+
+Ask the user to confirm pushing the branch and opening a PR (base `main`, using the actual fork/branch from `git remote get-url origin` and `git branch --show-current`). Once pushed, wait for `.github/workflows/zizmor.yml` and `.github/workflows/test.yml` to complete on GitHub's real runners/zizmor-action.
+
+**Do not proceed to Task 2 until both checks are green on the pushed commit.** This is the explicit "validate one migrated action in CI before rolling out repo-wide" acceptance criterion — it confirms the real GitHub-hosted runner and the real `zizmor-action@latest` behave as observed locally, not just the local `uvx` sandbox.
+
+---
+
+### Task 2: Root-level actions — `bump-version`, `create-branch`, `full-report`
+
+**Files:**
+- Modify: `bump-version/action.yml:39`
+- Modify: `create-branch/action.yml:42`
+- Modify: `full-report/action.yml:39,48,54,59`
+
+**Interfaces:** None.
+
+- [ ] **Step 1: Make the changes**
+
+```bash
+sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
+  bump-version/action.yml create-branch/action.yml full-report/action.yml
+rm bump-version/action.yml.bak create-branch/action.yml.bak full-report/action.yml.bak
+```
+
+Resulting lines must be exactly:
+- `bump-version/action.yml:39`: `      uses: $/git-sign`
+- `create-branch/action.yml:42`: `    - uses: $/bump-version`
+- `full-report/action.yml:39`: `      uses: $/authorized-pub`
+- `full-report/action.yml:48`: `      uses: $/sbom`
+- `full-report/action.yml:54`: `      uses: $/code-scanning-export`
+- `full-report/action.yml:59`: `      uses: $/compliance-report`
+
+- [ ] **Step 2: Validate schema locally**
+
+Run: `pre-commit run check-github-actions --files bump-version/action.yml create-branch/action.yml full-report/action.yml`
+Expected: `Passed`
+
+- [ ] **Step 3: Validate security lint locally**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml bump-version/action.yml create-branch/action.yml full-report/action.yml`
+Expected: no new findings beyond what existed for these files pre-migration (no `$/`-related or parse-error findings).
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add bump-version/action.yml create-branch/action.yml full-report/action.yml
+git commit -m "DRIVERS-3596 Migrate root-level actions to \$/ self-repository syntax"
+```
+
+---
+
+### Task 3: Golang actions
+
+**Files:**
+- Modify: `golang/pre-publish/action.yml:20,27`
+- Modify: `golang/publish/action.yml:27,46`
+
+**Interfaces:** None.
+
+- [ ] **Step 1: Make the changes**
+
+```bash
+sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
+  golang/pre-publish/action.yml golang/publish/action.yml
+rm golang/pre-publish/action.yml.bak golang/publish/action.yml.bak
+```
+
+Resulting lines:
+- `golang/pre-publish/action.yml:20`: `    - uses: $/bump-version`
+- `golang/pre-publish/action.yml:27`: `    - uses: $/tag-version`
+- `golang/publish/action.yml:27`: `    - uses: $/full-report`
+- `golang/publish/action.yml:46`: `      uses: $/upload-s3-assets`
+
+- [ ] **Step 2: Validate schema locally**
+
+Run: `pre-commit run check-github-actions --files golang/pre-publish/action.yml golang/publish/action.yml`
+Expected: `Passed`
+
+- [ ] **Step 3: Validate security lint locally**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml golang/pre-publish/action.yml golang/publish/action.yml`
+Expected: no new findings vs. pre-migration baseline for these two files.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add golang/pre-publish/action.yml golang/publish/action.yml
+git commit -m "DRIVERS-3596 Migrate golang actions to \$/ self-repository syntax"
+```
+
+---
+
+### Task 4: Node actions
+
+**Files:**
+- Modify: `node/release_template.yml:44,49,54,70,77,89,105`
+- Modify: `node/sign_node_package/action.yml:45,50,73`
+
+**Interfaces:** None.
+
+- [ ] **Step 1: Make the changes**
+
+```bash
+sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
+  node/release_template.yml node/sign_node_package/action.yml
+rm node/release_template.yml.bak node/sign_node_package/action.yml.bak
+```
+
+Resulting lines:
+- `node/release_template.yml:44`: `        uses: $/node/setup`
+- `node/release_template.yml:49`: `        uses: $/node/get_version_info`
+- `node/release_template.yml:54`: `        uses: $/node/sign_node_package`
+- `node/release_template.yml:70`: `        uses: $/sbom`
+- `node/release_template.yml:77`: `        uses: $/full-report`
+- `node/release_template.yml:89`: `      - uses: $/upload-s3-assets`
+- `node/release_template.yml:105`: `        uses: $/node/setup`
+- `node/sign_node_package/action.yml:45`: `      uses: $/node/get_version_info`
+- `node/sign_node_package/action.yml:50`: `      uses: $/setup`
+- `node/sign_node_package/action.yml:73`: `      uses: $/gpg-sign`
+
+Note: `node/release_template.yml:27` contains `uses: ./.github/workflows/build.yml` — a reusable-workflow relative reference, NOT part of this ticket's scope (the ticket only calls out the 37 `owner/repo@v3` self-references and the 2 `./`-relative refs in `update-action-tag.yml`). Leave this line untouched.
+
+- [ ] **Step 2: Validate schema locally**
+
+Run: `pre-commit run check-github-actions --files node/sign_node_package/action.yml`
+Expected: `Passed` (note: `check-github-actions`'s file filter only matches `action.yml`/`action.yaml`, not `release_template.yml`, so it won't lint that file — this is expected and pre-existing, not something to fix here).
+
+- [ ] **Step 3: Validate security lint locally**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml node/release_template.yml node/sign_node_package/action.yml`
+Expected: no new findings vs. pre-migration baseline for these two files.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add node/release_template.yml node/sign_node_package/action.yml
+git commit -m "DRIVERS-3596 Migrate node actions to \$/ self-repository syntax"
+```
+
+---
+
+### Task 5: Python and python-labs actions
+
+**Files:**
+- Modify: `python/pre-publish/action.yml:68,76`
+- Modify: `python/post-publish/action.yml:73,81,92,127`
+- Modify: `python-labs/pre-publish/action.yml:58`
+- Modify: `python-labs/post-publish/action.yml:76`
+
+**Interfaces:** None.
+
+- [ ] **Step 1: Make the changes**
+
+```bash
+sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
+  python/pre-publish/action.yml python/post-publish/action.yml \
+  python-labs/pre-publish/action.yml python-labs/post-publish/action.yml
+rm python/pre-publish/action.yml.bak python/post-publish/action.yml.bak \
+   python-labs/pre-publish/action.yml.bak python-labs/post-publish/action.yml.bak
+```
+
+Resulting lines:
+- `python/pre-publish/action.yml:68`: `      uses: $/bump-version`
+- `python/pre-publish/action.yml:76`: `      uses: $/tag-version`
+- `python/post-publish/action.yml:73`: `      uses: $/gpg-sign`
+- `python/post-publish/action.yml:81`: `    - uses: $/full-report`
+- `python/post-publish/action.yml:92`: `    - uses: $/upload-s3-assets`
+- `python/post-publish/action.yml:127`: `      uses: $/bump-version`
+- `python-labs/pre-publish/action.yml:58`: `      uses: $/tag-version`
+- `python-labs/post-publish/action.yml:76`: `      uses: $/bump-version`
+
+- [ ] **Step 2: Validate schema locally**
+
+Run: `pre-commit run check-github-actions --files python/pre-publish/action.yml python/post-publish/action.yml python-labs/pre-publish/action.yml python-labs/post-publish/action.yml`
+Expected: `Passed`
+
+- [ ] **Step 3: Validate security lint locally**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml python/pre-publish/action.yml python/post-publish/action.yml python-labs/pre-publish/action.yml python-labs/post-publish/action.yml`
+Expected: no new findings vs. pre-migration baseline for these four files.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add python/pre-publish/action.yml python/post-publish/action.yml \
+  python-labs/pre-publish/action.yml python-labs/post-publish/action.yml
+git commit -m "DRIVERS-3596 Migrate python and python-labs actions to \$/ self-repository syntax"
+```
+
+---
+
+### Task 6: Ruby actions
+
+**Files:**
+- Modify: `ruby/build/action.yml:37`
+- Modify: `ruby/cleanup/action.yml:18`
+- Modify: `ruby/publish/action.yml:60,83,97,102,125,179`
+
+**Interfaces:** None.
+
+- [ ] **Step 1: Make the changes**
+
+```bash
+sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
+  ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml
+rm ruby/build/action.yml.bak ruby/cleanup/action.yml.bak ruby/publish/action.yml.bak
+```
+
+Resulting lines:
+- `ruby/build/action.yml:37`: `      uses: $/secure-checkout`
+- `ruby/cleanup/action.yml:18`: `      uses: $/secure-checkout`
+- `ruby/publish/action.yml:60`: `      uses: $/secure-checkout`
+- `ruby/publish/action.yml:83`: `      uses: $/setup`
+- `ruby/publish/action.yml:97`: `      uses: $/gpg-sign`
+- `ruby/publish/action.yml:102`: `      uses: $/full-report`
+- `ruby/publish/action.yml:125`: `      uses: $/tag-version`
+- `ruby/publish/action.yml:179`: `      uses: $/upload-s3-assets`
+
+- [ ] **Step 2: Validate schema locally**
+
+Run: `pre-commit run check-github-actions --files ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml`
+Expected: `Passed`
+
+- [ ] **Step 3: Validate security lint locally**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml`
+Expected: no new findings vs. pre-migration baseline for these three files.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml
+git commit -m "DRIVERS-3596 Migrate ruby actions to \$/ self-repository syntax"
+```
+
+---
+
+### Task 7: `update-action-tag.yml` — replace `./`-relative references
+
+**Files:**
+- Modify: `.github/workflows/update-action-tag.yml:33,46`
+
+**Interfaces:** None.
+
+**Context:** The current file (lines 26–52) is:
+
+```yaml
+      - uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          # Needed to push the tag in the final step
+          persist-credentials: true
+
+      - name: Setup
+        uses: ./setup
+        with:
+          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
+          aws_region_name: ${{ vars.AWS_REGION_NAME }}
+          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
+
+      - name: Remove the existing tag
+        run: |
+          export VERSION=$(cat .github/workflows/version.txt)
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          git push origin ":v${VERSION}" || true
+
+      - name: Create a new signed tag
+        uses: ./git-sign
+        with:
+          command: git tag -a "v${{ env.VERSION }}" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
+
+      - name: Push the tag
+        run:
+            git push origin --tags
+```
+
+The `actions/checkout` step **must stay** — it is independently required for two things unrelated to resolving `./setup`/`./git-sign`: (1) the `Remove the existing tag` step reads `.github/workflows/version.txt` from the local working copy, and (2) `persist-credentials: true` is what allows the final `git push origin --tags` and the tag-removal `git push` to authenticate. Per the ticket's AC ("drop the checkout step if no longer needed"), it IS still needed — do not remove it.
+
+- [ ] **Step 1: Replace the two `./`-relative references**
+
+Use the Edit tool (exact string match, not sed, since `./setup`/`./git-sign` are short strings that could otherwise collide):
+
+Old:
+```yaml
+      - name: Setup
+        uses: ./setup
+```
+New:
+```yaml
+      - name: Setup
+        uses: $/setup
+```
+
+Old:
+```yaml
+      - name: Create a new signed tag
+        uses: ./git-sign
+```
+New:
+```yaml
+      - name: Create a new signed tag
+        uses: $/git-sign
+```
+
+- [ ] **Step 2: Validate schema locally**
+
+Run: `pre-commit run check-yaml --files .github/workflows/update-action-tag.yml`
+Expected: `Passed` (note: `check-github-actions`'s file filter only covers `action.yml`/`action.yaml`, not workflow files under `.github/workflows/`, so use `check-yaml` here instead).
+
+- [ ] **Step 3: Validate security lint locally**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml .github/workflows/update-action-tag.yml`
+Expected: no new findings vs. pre-migration baseline for this file, and specifically no finding about the retained `actions/checkout` step (it was already accepted pre-migration).
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add .github/workflows/update-action-tag.yml
+git commit -m "DRIVERS-3596 Migrate update-action-tag.yml to \$/ self-repository syntax"
+```
+
+---
+
+### Task 8: Update documentation
+
+**Files:**
+- Modify: `README.md:10-15`
+- Modify: `CONTRIBUTING.md:31-32`
+
+**Interfaces:** None.
+
+**Context:** `README.md`'s "Working on Actions" section currently says:
+
+```markdown
+## Working on Actions
+
+Many of the actions in this repo depend on one another.  There is no supported way to reference
+another action using a relative path.  Therefore the recommended approach is to
+set all of the relative actions to your branch name while working on a feature,
+then reverting to the version tag before merging.
+```
+
+This is now inaccurate — GitHub Actions' `$/` self-repository syntax (runner ≥ 2.336.0) is exactly the "relative path" reference this text says isn't supported, and this repo's internal actions now use it.
+
+- [ ] **Step 1: Update README.md**
+
+Old:
+```markdown
+## Working on Actions
+
+Many of the actions in this repo depend on one another.  There is no supported way to reference
+another action using a relative path.  Therefore the recommended approach is to
+set all of the relative actions to your branch name while working on a feature,
+then reverting to the version tag before merging.
+```
+New:
+```markdown
+## Working on Actions
+
+Many of the actions in this repo depend on one another. Internal action-to-action
+references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
+which always resolves to this repo at the exact commit currently running — no
+version pin or checkout needed. This requires an Actions runner >= 2.336.0
+(GitHub-hosted runners satisfy this automatically). Use `$/` for any new
+internal reference instead of a pinned `mongodb-labs/drivers-github-tools/...@v3`
+reference.
+```
+
+- [ ] **Step 2: Update CONTRIBUTING.md**
+
+Old:
+```markdown
+To change the major version, update `.github/workflows/version.txt` and all references to `mongodb-labs/drivers-github-tools`
+in the repo.
+```
+New:
+```markdown
+To change the major version, update `.github/workflows/version.txt`. Internal
+action-to-action references use `$/` and do not need updating on a version bump.
+Only update the example `mongodb-labs/drivers-github-tools/...@vX` references in
+`README.md`, which document the tag external consumers should pin to.
+```
+
+- [ ] **Step 3: Verify rendering**
+
+Run: `pre-commit run trailing-whitespace --files README.md CONTRIBUTING.md`
+Expected: `Passed`
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add README.md CONTRIBUTING.md
+git commit -m "DRIVERS-3596 Document \$/ self-repository syntax convention"
+```
+
+---
+
+### Task 9: Full-repo verification and final push
+
+**Files:** None modified — verification only.
+
+**Interfaces:** None.
+
+- [ ] **Step 1: Confirm zero remaining self-references outside README examples**
+
+Run: `grep -rn "uses:.*mongodb-labs/drivers-github-tools" --include="*.yml" --include="*.yaml" --exclude-dir=.git --exclude-dir=.venv .`
+Expected: zero matches (the only remaining `mongodb-labs/drivers-github-tools` mentions in the repo should be in `README.md`'s external-consumer example and `.github/zizmor.yml`'s `ref-pin` policy list, both intentionally unchanged).
+
+- [ ] **Step 2: Confirm zero remaining in-scope `./`-relative references**
+
+Run: `grep -n "uses: \./" .github/workflows/update-action-tag.yml`
+Expected: zero matches.
+
+- [ ] **Step 3: Run full pre-commit suite**
+
+Run: `pre-commit run --all-files`
+Expected: all hooks pass (or only pre-existing failures unrelated to this change — compare against a run on `main` before this branch's commits if any hook fails, to confirm it's not a regression).
+
+- [ ] **Step 4: Run full zizmor scan and diff against pre-migration baseline**
+
+Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml . 2>&1 | tail -5`
+Expected: the finding count/severity summary line matches the pre-migration baseline (89 findings: 4 informational, 10 low, 1 medium, 57 high — re-verify this baseline number on `main` at execution time, since it may drift from unrelated changes). There must be no new `unpinned-uses`, parse-error, or `$/`-related finding introduced by this migration.
+
+- [ ] **Step 5: Push remaining commits and confirm CI green**
+
+Ask the user for explicit confirmation before pushing (per repo safety rules). Push all commits from Tasks 2–8 to the same branch/PR opened in Task 1. Confirm `.github/workflows/zizmor.yml`, `.github/workflows/test.yml`, `.github/workflows/ci.yml`, and `.github/workflows/check-dist.yml` are all green on the final pushed state.
+
+- [ ] **Step 6: Prepare PR description**
+
+Per user's global CLAUDE.md instructions: keep the PR description high-level (what changed and why, not implementation mechanics), and there is no `.github` PR template in this repo to fill in (confirmed: `find .github -iname "*template*"` returns nothing). Reference DRIVERS-3596 and summarize: adopts GitHub's new `$/` self-repository syntax for the 37 internal action-to-action references (removing the recurring manual-retag maintenance cost), keeps `update-action-tag.yml` retagging `v3` for external consumers unchanged, and updates docs to reflect the new convention.

From 1cc9d12965d191990ac2dd50561cf4623089d6ad Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 06:47:30 -0500
Subject: [PATCH 03/18] DRIVERS-3596 Migrate tag-version to $/ self-repository
 syntax (canary)

---
 tag-version/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tag-version/action.yml b/tag-version/action.yml
index fa3df7f..89e9ef1 100644
--- a/tag-version/action.yml
+++ b/tag-version/action.yml
@@ -33,7 +33,7 @@ runs:
         export TAG_MESSAGE=$(echo "${{ inputs.tag_message_template }}" | envsubst)
         echo "TAG_MESSAGE=$TAG_MESSAGE" >> $GITHUB_ENV
     - name: Tag the version
-      uses: mongodb-labs/drivers-github-tools/git-sign@v3
+      uses: $/git-sign
       with:
         command: |-
           git tag -a "${{ env.TAG }}" -m "${{ env.TAG_MESSAGE }}" ${{ env.GPG_PUBLIC_URL != '' && format('-m "PGP-Signing-Key: {0}"', env.GPG_PUBLIC_URL) || '' }} -s --local-user=${{ env.GPG_KEY_ID }}

From b1930da109f92ee913e5b6710c1531cfb7b8a58e Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 07:35:17 -0500
Subject: [PATCH 04/18] Untrack local plan doc, ignore docs/superpowers/plans/

---
 .gitignore                                    |   1 +
 ...026-08-03-adopt-self-repo-action-syntax.md | 508 ------------------
 2 files changed, 1 insertion(+), 508 deletions(-)
 delete mode 100644 docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md

diff --git a/.gitignore b/.gitignore
index 7a95436..9b9d131 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 .superpowers/
+docs/superpowers/plans/
diff --git a/docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md b/docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md
deleted file mode 100644
index ddc139b..0000000
--- a/docs/superpowers/plans/2026-08-03-adopt-self-repo-action-syntax.md
+++ /dev/null
@@ -1,508 +0,0 @@
-# Adopt GitHub Actions Self-Repository Syntax Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Replace this repo's 37 internal `mongodb-labs/drivers-github-tools/<path>@v3` self-references (plus 2 `./`-relative references in `update-action-tag.yml`) with GitHub Actions' new `$/<path>` self-repository syntax, eliminating the recurring manual-retagging maintenance burden — without changing behavior for external consumers.
-
-**Architecture:** This is a mechanical YAML edit across 20 action/workflow files plus two doc updates. There is no application code and no unit-test suite here — correctness is verified via `pre-commit` (`check-github-actions` JSON-schema validation of `action.yml` files) and `zizmor` (GitHub Actions security static analysis, run both locally via `uvx` and in the repo's `.github/workflows/zizmor.yml` CI job). The rollout is staged: migrate one self-contained action first, push it, and confirm CI is green before migrating the rest, per the ticket's explicit acceptance criterion.
-
-**Tech Stack:** GitHub Actions (composite actions + reusable workflow YAML), `pre-commit`, `zizmor` (via `uvx zizmor`).
-
-**Ticket:** [DRIVERS-3596](https://jira.mongodb.org/browse/DRIVERS-3596)
-
-## Global Constraints
-
-- Every `$/<path>` reference must NOT include an `@{ref}` suffix — GitHub rejects `$/<path>@ref` as malformed. (Confirmed via `actions/runner#4457` and by testing: zizmor <1.29.0 errors with `malformed uses ref: missing @<ref>`.)
-- `$/` requires GitHub Actions runner ≥ 2.336.0 (shipped 2026-07-20). This repo has no self-hosted runners (`grep -rn "runs-on:" .github/workflows/*.yml` — all `ubuntu-latest`), so GitHub-hosted runners satisfy this automatically; there is nothing to configure.
-- The repo's zizmor CI job (`.github/workflows/zizmor.yml`) runs `zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0` with its `version` input left at the action's default of `"latest"` — this means CI will always fetch a zizmor build that understands `$/` (support landed in zizmor v1.29.0, 2026-08-01; verified locally that v1.28.0 fatally errors on `$/` refs but v1.29.0 parses them cleanly with zero new findings). No CI config change is required for this, but the canary step (Task 1) re-confirms it against the real CI environment, not just local `uvx`.
-- Keep `update-action-tag.yml` retagging `v3` for external consumers unchanged (AC4) — this migration only touches how actions reference each other *internally*; it does not change the public `owner/repo/path@v3` interface that driver repos consume.
-- No behavior change for any external consumer of these actions.
-
----
-
-## File Structure
-
-No new files are created. Files modified:
-
-- `tag-version/action.yml` — canary migration (Task 1)
-- `bump-version/action.yml`, `create-branch/action.yml`, `full-report/action.yml` — root-level actions (Task 2)
-- `golang/pre-publish/action.yml`, `golang/publish/action.yml` (Task 3)
-- `node/release_template.yml`, `node/sign_node_package/action.yml` (Task 4)
-- `python/pre-publish/action.yml`, `python/post-publish/action.yml`, `python-labs/pre-publish/action.yml`, `python-labs/post-publish/action.yml` (Task 5)
-- `ruby/build/action.yml`, `ruby/cleanup/action.yml`, `ruby/publish/action.yml` (Task 6)
-- `.github/workflows/update-action-tag.yml` (Task 7)
-- `README.md`, `CONTRIBUTING.md` (Task 8)
-
-Every task's substitution follows the same rule: a `uses:` line matching `mongodb-labs/drivers-github-tools/<PATH>@v3` becomes `uses: $/<PATH>` (same leading whitespace and any `- ` step-list prefix preserved, only the value changes).
-
----
-
-### Task 1: Canary migration — `tag-version/action.yml`
-
-**Files:**
-- Modify: `tag-version/action.yml:36`
-
-**Interfaces:** None — this is a leaf composite-action reference change with no signature implications for other tasks.
-
-- [ ] **Step 1: Make the change**
-
-```bash
-sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' tag-version/action.yml
-rm tag-version/action.yml.bak
-```
-
-Confirm the only change is line 36 becoming:
-```yaml
-      uses: $/git-sign
-```
-
-- [ ] **Step 2: Validate schema locally**
-
-Run: `pre-commit run check-github-actions --files tag-version/action.yml`
-Expected: `Passed`
-
-- [ ] **Step 3: Validate security lint locally**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml tag-version/action.yml`
-Expected: exits non-zero only due to pre-existing `template-injection`/`github-env` findings already present in this file before this change (verify by comparing against `uvx zizmor@1.29.0 --config .github/zizmor.yml .` run against the pre-migration `main` branch — the finding count and lines for `tag-version/action.yml` must be identical). There must be **no** finding referencing `$/git-sign`, and no parse/model error.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add tag-version/action.yml
-git commit -m "DRIVERS-3596 Migrate tag-version to \$/ self-repository syntax (canary)"
-```
-
-- [ ] **Step 5: Push and validate in real CI before continuing**
-
-This step requires the user's explicit go-ahead to push (per repo safety rules — pushing branches and opening PRs needs confirmation each time).
-
-Ask the user to confirm pushing the branch and opening a PR (base `main`, using the actual fork/branch from `git remote get-url origin` and `git branch --show-current`). Once pushed, wait for `.github/workflows/zizmor.yml` and `.github/workflows/test.yml` to complete on GitHub's real runners/zizmor-action.
-
-**Do not proceed to Task 2 until both checks are green on the pushed commit.** This is the explicit "validate one migrated action in CI before rolling out repo-wide" acceptance criterion — it confirms the real GitHub-hosted runner and the real `zizmor-action@latest` behave as observed locally, not just the local `uvx` sandbox.
-
----
-
-### Task 2: Root-level actions — `bump-version`, `create-branch`, `full-report`
-
-**Files:**
-- Modify: `bump-version/action.yml:39`
-- Modify: `create-branch/action.yml:42`
-- Modify: `full-report/action.yml:39,48,54,59`
-
-**Interfaces:** None.
-
-- [ ] **Step 1: Make the changes**
-
-```bash
-sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
-  bump-version/action.yml create-branch/action.yml full-report/action.yml
-rm bump-version/action.yml.bak create-branch/action.yml.bak full-report/action.yml.bak
-```
-
-Resulting lines must be exactly:
-- `bump-version/action.yml:39`: `      uses: $/git-sign`
-- `create-branch/action.yml:42`: `    - uses: $/bump-version`
-- `full-report/action.yml:39`: `      uses: $/authorized-pub`
-- `full-report/action.yml:48`: `      uses: $/sbom`
-- `full-report/action.yml:54`: `      uses: $/code-scanning-export`
-- `full-report/action.yml:59`: `      uses: $/compliance-report`
-
-- [ ] **Step 2: Validate schema locally**
-
-Run: `pre-commit run check-github-actions --files bump-version/action.yml create-branch/action.yml full-report/action.yml`
-Expected: `Passed`
-
-- [ ] **Step 3: Validate security lint locally**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml bump-version/action.yml create-branch/action.yml full-report/action.yml`
-Expected: no new findings beyond what existed for these files pre-migration (no `$/`-related or parse-error findings).
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add bump-version/action.yml create-branch/action.yml full-report/action.yml
-git commit -m "DRIVERS-3596 Migrate root-level actions to \$/ self-repository syntax"
-```
-
----
-
-### Task 3: Golang actions
-
-**Files:**
-- Modify: `golang/pre-publish/action.yml:20,27`
-- Modify: `golang/publish/action.yml:27,46`
-
-**Interfaces:** None.
-
-- [ ] **Step 1: Make the changes**
-
-```bash
-sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
-  golang/pre-publish/action.yml golang/publish/action.yml
-rm golang/pre-publish/action.yml.bak golang/publish/action.yml.bak
-```
-
-Resulting lines:
-- `golang/pre-publish/action.yml:20`: `    - uses: $/bump-version`
-- `golang/pre-publish/action.yml:27`: `    - uses: $/tag-version`
-- `golang/publish/action.yml:27`: `    - uses: $/full-report`
-- `golang/publish/action.yml:46`: `      uses: $/upload-s3-assets`
-
-- [ ] **Step 2: Validate schema locally**
-
-Run: `pre-commit run check-github-actions --files golang/pre-publish/action.yml golang/publish/action.yml`
-Expected: `Passed`
-
-- [ ] **Step 3: Validate security lint locally**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml golang/pre-publish/action.yml golang/publish/action.yml`
-Expected: no new findings vs. pre-migration baseline for these two files.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add golang/pre-publish/action.yml golang/publish/action.yml
-git commit -m "DRIVERS-3596 Migrate golang actions to \$/ self-repository syntax"
-```
-
----
-
-### Task 4: Node actions
-
-**Files:**
-- Modify: `node/release_template.yml:44,49,54,70,77,89,105`
-- Modify: `node/sign_node_package/action.yml:45,50,73`
-
-**Interfaces:** None.
-
-- [ ] **Step 1: Make the changes**
-
-```bash
-sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
-  node/release_template.yml node/sign_node_package/action.yml
-rm node/release_template.yml.bak node/sign_node_package/action.yml.bak
-```
-
-Resulting lines:
-- `node/release_template.yml:44`: `        uses: $/node/setup`
-- `node/release_template.yml:49`: `        uses: $/node/get_version_info`
-- `node/release_template.yml:54`: `        uses: $/node/sign_node_package`
-- `node/release_template.yml:70`: `        uses: $/sbom`
-- `node/release_template.yml:77`: `        uses: $/full-report`
-- `node/release_template.yml:89`: `      - uses: $/upload-s3-assets`
-- `node/release_template.yml:105`: `        uses: $/node/setup`
-- `node/sign_node_package/action.yml:45`: `      uses: $/node/get_version_info`
-- `node/sign_node_package/action.yml:50`: `      uses: $/setup`
-- `node/sign_node_package/action.yml:73`: `      uses: $/gpg-sign`
-
-Note: `node/release_template.yml:27` contains `uses: ./.github/workflows/build.yml` — a reusable-workflow relative reference, NOT part of this ticket's scope (the ticket only calls out the 37 `owner/repo@v3` self-references and the 2 `./`-relative refs in `update-action-tag.yml`). Leave this line untouched.
-
-- [ ] **Step 2: Validate schema locally**
-
-Run: `pre-commit run check-github-actions --files node/sign_node_package/action.yml`
-Expected: `Passed` (note: `check-github-actions`'s file filter only matches `action.yml`/`action.yaml`, not `release_template.yml`, so it won't lint that file — this is expected and pre-existing, not something to fix here).
-
-- [ ] **Step 3: Validate security lint locally**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml node/release_template.yml node/sign_node_package/action.yml`
-Expected: no new findings vs. pre-migration baseline for these two files.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add node/release_template.yml node/sign_node_package/action.yml
-git commit -m "DRIVERS-3596 Migrate node actions to \$/ self-repository syntax"
-```
-
----
-
-### Task 5: Python and python-labs actions
-
-**Files:**
-- Modify: `python/pre-publish/action.yml:68,76`
-- Modify: `python/post-publish/action.yml:73,81,92,127`
-- Modify: `python-labs/pre-publish/action.yml:58`
-- Modify: `python-labs/post-publish/action.yml:76`
-
-**Interfaces:** None.
-
-- [ ] **Step 1: Make the changes**
-
-```bash
-sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
-  python/pre-publish/action.yml python/post-publish/action.yml \
-  python-labs/pre-publish/action.yml python-labs/post-publish/action.yml
-rm python/pre-publish/action.yml.bak python/post-publish/action.yml.bak \
-   python-labs/pre-publish/action.yml.bak python-labs/post-publish/action.yml.bak
-```
-
-Resulting lines:
-- `python/pre-publish/action.yml:68`: `      uses: $/bump-version`
-- `python/pre-publish/action.yml:76`: `      uses: $/tag-version`
-- `python/post-publish/action.yml:73`: `      uses: $/gpg-sign`
-- `python/post-publish/action.yml:81`: `    - uses: $/full-report`
-- `python/post-publish/action.yml:92`: `    - uses: $/upload-s3-assets`
-- `python/post-publish/action.yml:127`: `      uses: $/bump-version`
-- `python-labs/pre-publish/action.yml:58`: `      uses: $/tag-version`
-- `python-labs/post-publish/action.yml:76`: `      uses: $/bump-version`
-
-- [ ] **Step 2: Validate schema locally**
-
-Run: `pre-commit run check-github-actions --files python/pre-publish/action.yml python/post-publish/action.yml python-labs/pre-publish/action.yml python-labs/post-publish/action.yml`
-Expected: `Passed`
-
-- [ ] **Step 3: Validate security lint locally**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml python/pre-publish/action.yml python/post-publish/action.yml python-labs/pre-publish/action.yml python-labs/post-publish/action.yml`
-Expected: no new findings vs. pre-migration baseline for these four files.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add python/pre-publish/action.yml python/post-publish/action.yml \
-  python-labs/pre-publish/action.yml python-labs/post-publish/action.yml
-git commit -m "DRIVERS-3596 Migrate python and python-labs actions to \$/ self-repository syntax"
-```
-
----
-
-### Task 6: Ruby actions
-
-**Files:**
-- Modify: `ruby/build/action.yml:37`
-- Modify: `ruby/cleanup/action.yml:18`
-- Modify: `ruby/publish/action.yml:60,83,97,102,125,179`
-
-**Interfaces:** None.
-
-- [ ] **Step 1: Make the changes**
-
-```bash
-sed -i.bak -E 's#uses: mongodb-labs/drivers-github-tools/([^@]+)@v3#uses: $/\1#' \
-  ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml
-rm ruby/build/action.yml.bak ruby/cleanup/action.yml.bak ruby/publish/action.yml.bak
-```
-
-Resulting lines:
-- `ruby/build/action.yml:37`: `      uses: $/secure-checkout`
-- `ruby/cleanup/action.yml:18`: `      uses: $/secure-checkout`
-- `ruby/publish/action.yml:60`: `      uses: $/secure-checkout`
-- `ruby/publish/action.yml:83`: `      uses: $/setup`
-- `ruby/publish/action.yml:97`: `      uses: $/gpg-sign`
-- `ruby/publish/action.yml:102`: `      uses: $/full-report`
-- `ruby/publish/action.yml:125`: `      uses: $/tag-version`
-- `ruby/publish/action.yml:179`: `      uses: $/upload-s3-assets`
-
-- [ ] **Step 2: Validate schema locally**
-
-Run: `pre-commit run check-github-actions --files ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml`
-Expected: `Passed`
-
-- [ ] **Step 3: Validate security lint locally**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml`
-Expected: no new findings vs. pre-migration baseline for these three files.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add ruby/build/action.yml ruby/cleanup/action.yml ruby/publish/action.yml
-git commit -m "DRIVERS-3596 Migrate ruby actions to \$/ self-repository syntax"
-```
-
----
-
-### Task 7: `update-action-tag.yml` — replace `./`-relative references
-
-**Files:**
-- Modify: `.github/workflows/update-action-tag.yml:33,46`
-
-**Interfaces:** None.
-
-**Context:** The current file (lines 26–52) is:
-
-```yaml
-      - uses: actions/checkout@v7
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          # Needed to push the tag in the final step
-          persist-credentials: true
-
-      - name: Setup
-        uses: ./setup
-        with:
-          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
-          aws_region_name: ${{ vars.AWS_REGION_NAME }}
-          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
-
-      - name: Remove the existing tag
-        run: |
-          export VERSION=$(cat .github/workflows/version.txt)
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-          git push origin ":v${VERSION}" || true
-
-      - name: Create a new signed tag
-        uses: ./git-sign
-        with:
-          command: git tag -a "v${{ env.VERSION }}" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
-
-      - name: Push the tag
-        run:
-            git push origin --tags
-```
-
-The `actions/checkout` step **must stay** — it is independently required for two things unrelated to resolving `./setup`/`./git-sign`: (1) the `Remove the existing tag` step reads `.github/workflows/version.txt` from the local working copy, and (2) `persist-credentials: true` is what allows the final `git push origin --tags` and the tag-removal `git push` to authenticate. Per the ticket's AC ("drop the checkout step if no longer needed"), it IS still needed — do not remove it.
-
-- [ ] **Step 1: Replace the two `./`-relative references**
-
-Use the Edit tool (exact string match, not sed, since `./setup`/`./git-sign` are short strings that could otherwise collide):
-
-Old:
-```yaml
-      - name: Setup
-        uses: ./setup
-```
-New:
-```yaml
-      - name: Setup
-        uses: $/setup
-```
-
-Old:
-```yaml
-      - name: Create a new signed tag
-        uses: ./git-sign
-```
-New:
-```yaml
-      - name: Create a new signed tag
-        uses: $/git-sign
-```
-
-- [ ] **Step 2: Validate schema locally**
-
-Run: `pre-commit run check-yaml --files .github/workflows/update-action-tag.yml`
-Expected: `Passed` (note: `check-github-actions`'s file filter only covers `action.yml`/`action.yaml`, not workflow files under `.github/workflows/`, so use `check-yaml` here instead).
-
-- [ ] **Step 3: Validate security lint locally**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml .github/workflows/update-action-tag.yml`
-Expected: no new findings vs. pre-migration baseline for this file, and specifically no finding about the retained `actions/checkout` step (it was already accepted pre-migration).
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add .github/workflows/update-action-tag.yml
-git commit -m "DRIVERS-3596 Migrate update-action-tag.yml to \$/ self-repository syntax"
-```
-
----
-
-### Task 8: Update documentation
-
-**Files:**
-- Modify: `README.md:10-15`
-- Modify: `CONTRIBUTING.md:31-32`
-
-**Interfaces:** None.
-
-**Context:** `README.md`'s "Working on Actions" section currently says:
-
-```markdown
-## Working on Actions
-
-Many of the actions in this repo depend on one another.  There is no supported way to reference
-another action using a relative path.  Therefore the recommended approach is to
-set all of the relative actions to your branch name while working on a feature,
-then reverting to the version tag before merging.
-```
-
-This is now inaccurate — GitHub Actions' `$/` self-repository syntax (runner ≥ 2.336.0) is exactly the "relative path" reference this text says isn't supported, and this repo's internal actions now use it.
-
-- [ ] **Step 1: Update README.md**
-
-Old:
-```markdown
-## Working on Actions
-
-Many of the actions in this repo depend on one another.  There is no supported way to reference
-another action using a relative path.  Therefore the recommended approach is to
-set all of the relative actions to your branch name while working on a feature,
-then reverting to the version tag before merging.
-```
-New:
-```markdown
-## Working on Actions
-
-Many of the actions in this repo depend on one another. Internal action-to-action
-references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
-which always resolves to this repo at the exact commit currently running — no
-version pin or checkout needed. This requires an Actions runner >= 2.336.0
-(GitHub-hosted runners satisfy this automatically). Use `$/` for any new
-internal reference instead of a pinned `mongodb-labs/drivers-github-tools/...@v3`
-reference.
-```
-
-- [ ] **Step 2: Update CONTRIBUTING.md**
-
-Old:
-```markdown
-To change the major version, update `.github/workflows/version.txt` and all references to `mongodb-labs/drivers-github-tools`
-in the repo.
-```
-New:
-```markdown
-To change the major version, update `.github/workflows/version.txt`. Internal
-action-to-action references use `$/` and do not need updating on a version bump.
-Only update the example `mongodb-labs/drivers-github-tools/...@vX` references in
-`README.md`, which document the tag external consumers should pin to.
-```
-
-- [ ] **Step 3: Verify rendering**
-
-Run: `pre-commit run trailing-whitespace --files README.md CONTRIBUTING.md`
-Expected: `Passed`
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add README.md CONTRIBUTING.md
-git commit -m "DRIVERS-3596 Document \$/ self-repository syntax convention"
-```
-
----
-
-### Task 9: Full-repo verification and final push
-
-**Files:** None modified — verification only.
-
-**Interfaces:** None.
-
-- [ ] **Step 1: Confirm zero remaining self-references outside README examples**
-
-Run: `grep -rn "uses:.*mongodb-labs/drivers-github-tools" --include="*.yml" --include="*.yaml" --exclude-dir=.git --exclude-dir=.venv .`
-Expected: zero matches (the only remaining `mongodb-labs/drivers-github-tools` mentions in the repo should be in `README.md`'s external-consumer example and `.github/zizmor.yml`'s `ref-pin` policy list, both intentionally unchanged).
-
-- [ ] **Step 2: Confirm zero remaining in-scope `./`-relative references**
-
-Run: `grep -n "uses: \./" .github/workflows/update-action-tag.yml`
-Expected: zero matches.
-
-- [ ] **Step 3: Run full pre-commit suite**
-
-Run: `pre-commit run --all-files`
-Expected: all hooks pass (or only pre-existing failures unrelated to this change — compare against a run on `main` before this branch's commits if any hook fails, to confirm it's not a regression).
-
-- [ ] **Step 4: Run full zizmor scan and diff against pre-migration baseline**
-
-Run: `uvx zizmor@1.29.0 --config .github/zizmor.yml . 2>&1 | tail -5`
-Expected: the finding count/severity summary line matches the pre-migration baseline (89 findings: 4 informational, 10 low, 1 medium, 57 high — re-verify this baseline number on `main` at execution time, since it may drift from unrelated changes). There must be no new `unpinned-uses`, parse-error, or `$/`-related finding introduced by this migration.
-
-- [ ] **Step 5: Push remaining commits and confirm CI green**
-
-Ask the user for explicit confirmation before pushing (per repo safety rules). Push all commits from Tasks 2–8 to the same branch/PR opened in Task 1. Confirm `.github/workflows/zizmor.yml`, `.github/workflows/test.yml`, `.github/workflows/ci.yml`, and `.github/workflows/check-dist.yml` are all green on the final pushed state.
-
-- [ ] **Step 6: Prepare PR description**
-
-Per user's global CLAUDE.md instructions: keep the PR description high-level (what changed and why, not implementation mechanics), and there is no `.github` PR template in this repo to fill in (confirmed: `find .github -iname "*template*"` returns nothing). Reference DRIVERS-3596 and summarize: adopts GitHub's new `$/` self-repository syntax for the 37 internal action-to-action references (removing the recurring manual-retag maintenance cost), keeps `update-action-tag.yml` retagging `v3` for external consumers unchanged, and updates docs to reflect the new convention.

From 4517ebc968b9fa895c6339e3da4f9e5023a8c77a Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 07:42:18 -0500
Subject: [PATCH 05/18] DRIVERS-3596 Bump pinned zizmor-action to v0.6.2 so
 latest resolves to zizmor 1.29.0 ($/ support)

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 9c9846d..e978f2d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -21,4 +21,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
\ No newline at end of file
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
\ No newline at end of file

From be5b3dc6e4c0e09beb2196fdad14b3bb672d2e35 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 08:44:11 -0500
Subject: [PATCH 06/18] DRIVERS-3596 Migrate root-level actions to $/
 self-repository syntax

---
 bump-version/action.yml  | 2 +-
 create-branch/action.yml | 2 +-
 full-report/action.yml   | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/bump-version/action.yml b/bump-version/action.yml
index eb591c5..2378cb9 100644
--- a/bump-version/action.yml
+++ b/bump-version/action.yml
@@ -36,7 +36,7 @@ runs:
         export COMMIT_MESSAGE=$(echo "${{ inputs.commit_template }}" | envsubst)
         echo "COMMIT_MESSAGE=$COMMIT_MESSAGE" >> $GITHUB_ENV
     - name: Commit the version bump
-      uses: mongodb-labs/drivers-github-tools/git-sign@v3
+      uses: $/git-sign
       with:
         command: |-
           git commit -a -m "${{ env.COMMIT_MESSAGE }}" ${{ env.GPG_PUBLIC_URL != '' && format('-m "PGP-Signing-Key: {0}"', env.GPG_PUBLIC_URL) || '' }} -s --gpg-sign=${{ env.GPG_KEY_ID }}
diff --git a/create-branch/action.yml b/create-branch/action.yml
index 45c2c79..b1b1502 100644
--- a/create-branch/action.yml
+++ b/create-branch/action.yml
@@ -39,7 +39,7 @@ runs:
         RELEASE_WORKFLOW_PATH: ${{ inputs.release_workflow_path }}
         EVERGREEN_PROJECT: ${{ inputs.evergreen_project }}
       run: ${{ github.action_path }}/create-branch.sh
-    - uses: mongodb-labs/drivers-github-tools/bump-version@v3
+    - uses: $/bump-version
       with:
         version: ${{ inputs.version }}
         version_bump_script: ${{ inputs.version_bump_script }}
diff --git a/full-report/action.yml b/full-report/action.yml
index 1c2e244..179b5e8 100644
--- a/full-report/action.yml
+++ b/full-report/action.yml
@@ -36,7 +36,7 @@ runs:
   using: composite
   steps:
     - name: Generate Authorized Publication Report
-      uses: mongodb-labs/drivers-github-tools/authorized-pub@v3
+      uses: $/authorized-pub
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ inputs.release_version }}
@@ -45,18 +45,18 @@ runs:
     - name: Generate SBOM File
       # not all packages have third party dependencies, and so not all packages produce sboms.
       if: ${{ inputs.sbom_in_path }}
-      uses: mongodb-labs/drivers-github-tools/sbom@v3
+      uses: $/sbom
       with:
         sbom_file_name: ${{ inputs.sbom_file_name }}
         kondukto_sub_project: ${{ inputs.kondukto_sub_project }}
         sbom_in_path: ${{ inputs.sbom_in_path }}
     - name: Generate Sarif File
-      uses: mongodb-labs/drivers-github-tools/code-scanning-export@v3
+      uses: $/code-scanning-export
       with:
         ref: ${{ inputs.sarif_report_target_ref || inputs.release_version }}
         output-file: ${{ env.S3_ASSETS }}/code-scanning-alerts.json
     - name: Generate Compliance Report
-      uses: mongodb-labs/drivers-github-tools/compliance-report@v3
+      uses: $/compliance-report
       with:
         release_version: ${{ inputs.release_version }}
         security_report_location: ${{ inputs.security_report_location }}

From 4a63db4fca938d0c9050ff4c4ad7fd8916fe13f9 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 08:52:35 -0500
Subject: [PATCH 07/18] DRIVERS-3596 Migrate golang actions to $/
 self-repository syntax

---
 golang/pre-publish/action.yml | 4 ++--
 golang/publish/action.yml     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/golang/pre-publish/action.yml b/golang/pre-publish/action.yml
index 0b55278..5309936 100644
--- a/golang/pre-publish/action.yml
+++ b/golang/pre-publish/action.yml
@@ -17,14 +17,14 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: mongodb-labs/drivers-github-tools/bump-version@v3
+    - uses: $/bump-version
       with:
         version: ${{ inputs.version }}
         version_bump_script: "go run ${{ github.action_path }}/bump-version.go"
         commit_template: "BUMP v${VERSION}"
         # Never push commit, we still need to merge up if a push is requested
         push_commit: false
-    - uses: mongodb-labs/drivers-github-tools/tag-version@v3
+    - uses: $/tag-version
       with:
         version: v${{ inputs.version }}
         push_tag: ${{ inputs.push_changes }}
diff --git a/golang/publish/action.yml b/golang/publish/action.yml
index a942f02..69d3ed2 100644
--- a/golang/publish/action.yml
+++ b/golang/publish/action.yml
@@ -24,7 +24,7 @@ runs:
       shell: bash
       run: |
         echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-    - uses: mongodb-labs/drivers-github-tools/full-report@v3
+    - uses: $/full-report
       with:
         product_name: mongo-go-driver
         release_version: ${{ inputs.version }}
@@ -43,7 +43,7 @@ runs:
         GH_TOKEN: ${{ inputs.token }}
       run: ./publish.sh
     - name: Upload S3 assets
-      uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+      uses: $/upload-s3-assets
       with:
           version: ${{ inputs.version }}
           product_name: mongo-go-driver

From 345fca882311403a7c1ca90558de8c7e7b1747e0 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 09:27:50 -0500
Subject: [PATCH 08/18] DRIVERS-3596 Migrate node actions to $/ self-repository
 syntax

---
 node/release_template.yml         | 14 +++++++-------
 node/sign_node_package/action.yml |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/node/release_template.yml b/node/release_template.yml
index 03c5fbe..26077af 100644
--- a/node/release_template.yml
+++ b/node/release_template.yml
@@ -41,17 +41,17 @@ jobs:
           persist-credentials: false
 
       - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v3
+        uses: $/node/setup
         with:
           ignore_install_scripts: IGNORE_INSTALL_SCRIPTS
 
       - name: Load version and package info
-        uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
+        uses: $/node/get_version_info
         with:
           npm_package_name: RELEASE_PACKAGE
 
       - name: actions/compress_sign_and_upload
-        uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v3
+        uses: $/node/sign_node_package
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: us-east-1
@@ -67,14 +67,14 @@ jobs:
       # only used for mongodb-client-encryption
       - name: Augment SBOM and copy to release assets
         if: ${{ SBOM_IN_PATH != '' }}
-        uses: mongodb-labs/drivers-github-tools/sbom@v3
+        uses: $/sbom
         with:
           sbom_in_path: SBOM_IN_PATH
           kondukto_sub_project: KONDUKTO_SUB_PROJECT
           sbom_file_name: sbom.json
 
       - name: Generate authorized pub report
-        uses: mongodb-labs/drivers-github-tools/full-report@v3
+        uses: $/full-report
         with:
           release_version: ${{ env.package_version }}
           product_name: RELEASE_PACKAGE
@@ -86,7 +86,7 @@ jobs:
           evergreen_project: EVERGREEN_PROJECT
           evergreen_commit: ${{ env.commit }}
 
-      - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+      - uses: $/upload-s3-assets
         with:
           version: ${{ env.package_version }}
           product_name: RELEASE_PACKAGE
@@ -102,7 +102,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v3
+        uses: $/node/setup
 
       - run: npm publish --provenance --tag=RELEASE_TAG
         if: ${{ needs.release_please.outputs.release_created }}
diff --git a/node/sign_node_package/action.yml b/node/sign_node_package/action.yml
index 585d3c2..9cc66db 100644
--- a/node/sign_node_package/action.yml
+++ b/node/sign_node_package/action.yml
@@ -42,12 +42,12 @@ runs:
         mkdir ${{ inputs.artifact_directory }}
 
     - name: Load version and package info
-      uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
+      uses: $/node/get_version_info
       with:
         npm_package_name: ${{ inputs.npm_package_name }}
 
     - name: Set up drivers-github-tools
-      uses: mongodb-labs/drivers-github-tools/setup@v3
+      uses: $/setup
       with:
         aws_region_name: ${{ inputs.aws_region_name }}
         aws_role_arn: ${{ inputs.aws_role_arn }}
@@ -70,7 +70,7 @@ runs:
         echo "FILES_TO_SIGN=${FILENAMES}" >> "$GITHUB_ENV"
 
     - name: Create detached signature
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: ${{ env.FILES_TO_SIGN }}
       env:

From 871780d524e9f2f6804275ae4882524f21fd2b98 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 09:32:28 -0500
Subject: [PATCH 09/18] DRIVERS-3596 Migrate python and python-labs actions to
 $/ self-repository syntax

---
 python-labs/post-publish/action.yml | 2 +-
 python-labs/pre-publish/action.yml  | 2 +-
 python/post-publish/action.yml      | 8 ++++----
 python/pre-publish/action.yml       | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/python-labs/post-publish/action.yml b/python-labs/post-publish/action.yml
index 3721594..1ab2881 100644
--- a/python-labs/post-publish/action.yml
+++ b/python-labs/post-publish/action.yml
@@ -73,7 +73,7 @@ runs:
         git clean -dffx
         git pull origin ${GITHUB_REF}
     - name: Set following version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: inputs.dry_run == 'false'
       with:
           version: ${{ steps.publish-script.outputs.following_version }}
diff --git a/python-labs/pre-publish/action.yml b/python-labs/pre-publish/action.yml
index b3e0cda..2eb31a1 100644
--- a/python-labs/pre-publish/action.yml
+++ b/python-labs/pre-publish/action.yml
@@ -55,7 +55,7 @@ runs:
         echo "VERSION=$VERSION" >> $GITHUB_ENV
         rm -rf dist
     - name: Tag version
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       with:
         version: ${{ env.VERSION }}
         tag_template: ${{ inputs.tag_template }}
diff --git a/python/post-publish/action.yml b/python/post-publish/action.yml
index 191b87b..f542271 100644
--- a/python/post-publish/action.yml
+++ b/python/post-publish/action.yml
@@ -70,7 +70,7 @@ runs:
           echo "VERSION=$VERSION" >> $GITHUB_ENV
         fi
     - name: Create detached signature for dist files
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: dist/*
     - name: Get the evergreen commit
@@ -78,7 +78,7 @@ runs:
       shell: bash
       run: |
         echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-    - uses: mongodb-labs/drivers-github-tools/full-report@v3
+    - uses: $/full-report
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ env.VERSION }}
@@ -89,7 +89,7 @@ runs:
         evergreen_project: ${{ inputs.evergreen_project }}
         evergreen_commit: ${{ steps.evergreen-commit.outputs.commit }}
         token: ${{ inputs.token }}
-    - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+    - uses: $/upload-s3-assets
       with:
           version: ${{ env.VERSION }}
           product_name: ${{ inputs.product_name }}
@@ -124,7 +124,7 @@ runs:
         git clean -dffx
         git pull origin ${GITHUB_REF}
     - name: Set following version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: inputs.dry_run == 'false'
       with:
           version: ${{ steps.publish-script.outputs.following_version }}
diff --git a/python/pre-publish/action.yml b/python/pre-publish/action.yml
index 5ffde7b..a16cc97 100644
--- a/python/pre-publish/action.yml
+++ b/python/pre-publish/action.yml
@@ -65,7 +65,7 @@ runs:
           echo "VERSION=$VERSION" >> $GITHUB_ENV
         fi
     - name: Set version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: ${{ inputs.version }}
       with:
         version: ${{ env.VERSION }}
@@ -73,7 +73,7 @@ runs:
         working_directory: ${{ inputs.working_directory }}
         push_commit: ${{ env.PUSH_CHANGES }}
     - name: Tag version
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       with:
         version: ${{ env.VERSION }}
         tag_template: ${{ inputs.tag_template }}

From a8ffc46d3a300831cba7c7aff5bec439ae8709e5 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 10:10:27 -0500
Subject: [PATCH 10/18] DRIVERS-3596 Migrate ruby actions to $/ self-repository
 syntax

---
 ruby/build/action.yml   |  2 +-
 ruby/cleanup/action.yml |  2 +-
 ruby/publish/action.yml | 12 ++++++------
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/ruby/build/action.yml b/ruby/build/action.yml
index 3c81c0c..a124f26 100644
--- a/ruby/build/action.yml
+++ b/ruby/build/action.yml
@@ -34,7 +34,7 @@ runs:
   using: composite
   steps:
     - name: Check out the repository
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}
diff --git a/ruby/cleanup/action.yml b/ruby/cleanup/action.yml
index e6801f1..9a81aa0 100644
--- a/ruby/cleanup/action.yml
+++ b/ruby/cleanup/action.yml
@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: 'Check out the repository'
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}
diff --git a/ruby/publish/action.yml b/ruby/publish/action.yml
index 87ddc53..a973127 100644
--- a/ruby/publish/action.yml
+++ b/ruby/publish/action.yml
@@ -57,7 +57,7 @@ runs:
   using: composite
   steps:
     - name: Check out the repository
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}
@@ -80,7 +80,7 @@ runs:
       run: echo "version=$(bundle exec rake version)" >> "$GITHUB_OUTPUT"
 
     - name: Setup GitHub tooling for DBX Drivers
-      uses: mongodb-labs/drivers-github-tools/setup@v3
+      uses: $/setup
       with:
         aws_role_arn: ${{ inputs.aws_role_arn }}
         aws_region_name: ${{ inputs.aws_region_name }}
@@ -94,12 +94,12 @@ runs:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     - name: Sign the gems
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: '*.gem'
 
     - name: Generate SSDLC Reports
-      uses: mongodb-labs/drivers-github-tools/full-report@v3
+      uses: $/full-report
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ steps.release_version.outputs.version }}
@@ -122,7 +122,7 @@ runs:
         fi
 
     - name: Create the tag
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       if: steps.tag_exists.outputs.exists == 'false'
       with:
         version: ${{ steps.release_version.outputs.version }}
@@ -176,7 +176,7 @@ runs:
       run: gh release upload --clobber v${RELEASE_VERSION} *.gem ${RELEASE_ASSETS}/*.sig
 
     - name: Upload S3 assets
-      uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+      uses: $/upload-s3-assets
       with:
         version: ${{ steps.release_version.outputs.version }}
         product_name: ${{ inputs.product_id }}

From 988e0875edc2db9af0def5c60005157e7fee9538 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 10:17:06 -0500
Subject: [PATCH 11/18] DRIVERS-3596 Migrate update-action-tag.yml to $/
 self-repository syntax

---
 .github/workflows/update-action-tag.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-action-tag.yml b/.github/workflows/update-action-tag.yml
index d1519be..3dd4902 100644
--- a/.github/workflows/update-action-tag.yml
+++ b/.github/workflows/update-action-tag.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: true
 
       - name: Setup
-        uses: ./setup
+        uses: $/setup
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
@@ -43,7 +43,7 @@ jobs:
           git push origin ":v${VERSION}" || true
 
       - name: Create a new signed tag
-        uses: ./git-sign
+        uses: $/git-sign
         with:
           command: git tag -a "v${{ env.VERSION }}" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
 

From f4322f8f9c5697a53ca31d802558b626b40c2eae Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 10:20:31 -0500
Subject: [PATCH 12/18] DRIVERS-3596 Document $/ self-repository syntax
 convention

---
 CONTRIBUTING.md |  6 ++++--
 README.md       | 11 +++++++----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 253e6a7..a999fb7 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -28,5 +28,7 @@ pre-commit run --all-files --hook-stage manual shellcheck
 
 To bump the version tag, run the "Update Tag" [workflow](https://github.com/mongodb-labs/drivers-github-tools/actions/workflows/update-action-tag.yml).
 
-To change the major version, update `.github/workflows/version.txt` and all references to `mongodb-labs/drivers-github-tools`
-in the repo.
\ No newline at end of file
+To change the major version, update `.github/workflows/version.txt`. Internal
+action-to-action references use `$/` and do not need updating on a version bump.
+Only update the example `mongodb-labs/drivers-github-tools/...@vX` references in
+`README.md`, which document the tag external consumers should pin to.
\ No newline at end of file
diff --git a/README.md b/README.md
index d23f9c1..2792b15 100644
--- a/README.md
+++ b/README.md
@@ -9,10 +9,13 @@ See the [How To: Set up Secure Release Process using GitHub Action](https://wiki
 
 ## Working on Actions
 
-Many of the actions in this repo depend on one another.  There is no supported way to reference
-another action using a relative path.  Therefore the recommended approach is to
-set all of the relative actions to your branch name while working on a feature,
-then reverting to the version tag before merging.
+Many of the actions in this repo depend on one another. Internal action-to-action
+references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
+which always resolves to this repo at the exact commit currently running — no
+version pin or checkout needed. This requires an Actions runner >= 2.336.0
+(GitHub-hosted runners satisfy this automatically). Use `$/` for any new
+internal reference instead of a pinned `mongodb-labs/drivers-github-tools/...@v3`
+reference.
 
 ## Consuming Actions
 

From 4478d3001a2946e1f75b869bc6609df39f6473dc Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 10:58:37 -0500
Subject: [PATCH 13/18] DRIVERS-3596 Revert node/release_template.yml to pinned
 refs, fix docs

---
 CONTRIBUTING.md           |  5 +++--
 README.md                 | 26 ++++++++++++++++++++------
 node/release_template.yml | 15 ++++++++-------
 3 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a999fb7..e8f4212 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -30,5 +30,6 @@ To bump the version tag, run the "Update Tag" [workflow](https://github.com/mong
 
 To change the major version, update `.github/workflows/version.txt`. Internal
 action-to-action references use `$/` and do not need updating on a version bump.
-Only update the example `mongodb-labs/drivers-github-tools/...@vX` references in
-`README.md`, which document the tag external consumers should pin to.
\ No newline at end of file
+Update the example `mongodb-labs/drivers-github-tools/...@vX` references in
+`README.md` and `node/release_template.yml`, both of which document or use the
+tag external consumers should pin to.
\ No newline at end of file
diff --git a/README.md b/README.md
index 2792b15..3cada10 100644
--- a/README.md
+++ b/README.md
@@ -10,12 +10,20 @@ See the [How To: Set up Secure Release Process using GitHub Action](https://wiki
 ## Working on Actions
 
 Many of the actions in this repo depend on one another. Internal action-to-action
-references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
-which always resolves to this repo at the exact commit currently running — no
-version pin or checkout needed. This requires an Actions runner >= 2.336.0
-(GitHub-hosted runners satisfy this automatically). Use `$/` for any new
-internal reference instead of a pinned `mongodb-labs/drivers-github-tools/...@v3`
-reference.
+references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`).
+`$/` resolves to the repository and ref of the file that contains the reference.
+For an action or workflow that runs in this repo, that means this repo at the
+exact commit currently running, so no version pin or checkout is needed. This
+requires an Actions runner >= 2.336.0 (GitHub-hosted runners satisfy this
+automatically). Use `$/` for any new internal reference instead of a pinned
+`mongodb-labs/drivers-github-tools/...@v3` reference.
+
+The one exception is `node/release_template.yml`. It is not a workflow that runs
+in this repo, it is a template that `node/generate_release.mjs` renders into
+driver repos as their own release workflow. A `$/` reference in that file would
+resolve to the driver repo it ends up living in, not to this repo, so
+`node/release_template.yml` must keep pinned `owner/repo/path@vX` references
+instead of `$/`.
 
 ## Consuming Actions
 
@@ -23,6 +31,12 @@ It is recommended that you use Dependabot and use an explicit reference when
 using these actions.  This will allow Dependabot to update to a more recent sha
 and allow you to accept updates to the actions as needed.
 
+Note that internal sub-action references now resolve to the same ref the
+top-level action was pinned to. This means pinning an old sha of a top-level
+action also freezes its internal sub-action dependencies at that same point,
+rather than always picking up the latest tagged version of the sub-action.
+Bump your pin to pick up sub-action updates too.
+
 Example `dependabot.yml`:
 
 ```yaml
diff --git a/node/release_template.yml b/node/release_template.yml
index 26077af..f1281fd 100644
--- a/node/release_template.yml
+++ b/node/release_template.yml
@@ -1,3 +1,4 @@
+# This is a template rendered into consumer repos by generate_release.mjs, so it must keep pinned owner/repo/path@vX references (not $/), since $/ resolves relative to whatever repo the rendered workflow ends up living in, not this repo.
 on:
   push:
     branches: [RELEASE_BRANCH]
@@ -41,17 +42,17 @@ jobs:
           persist-credentials: false
 
       - name: Install Node and dependencies
-        uses: $/node/setup
+        uses: mongodb-labs/drivers-github-tools/node/setup@v3
         with:
           ignore_install_scripts: IGNORE_INSTALL_SCRIPTS
 
       - name: Load version and package info
-        uses: $/node/get_version_info
+        uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
         with:
           npm_package_name: RELEASE_PACKAGE
 
       - name: actions/compress_sign_and_upload
-        uses: $/node/sign_node_package
+        uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v3
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: us-east-1
@@ -67,14 +68,14 @@ jobs:
       # only used for mongodb-client-encryption
       - name: Augment SBOM and copy to release assets
         if: ${{ SBOM_IN_PATH != '' }}
-        uses: $/sbom
+        uses: mongodb-labs/drivers-github-tools/sbom@v3
         with:
           sbom_in_path: SBOM_IN_PATH
           kondukto_sub_project: KONDUKTO_SUB_PROJECT
           sbom_file_name: sbom.json
 
       - name: Generate authorized pub report
-        uses: $/full-report
+        uses: mongodb-labs/drivers-github-tools/full-report@v3
         with:
           release_version: ${{ env.package_version }}
           product_name: RELEASE_PACKAGE
@@ -86,7 +87,7 @@ jobs:
           evergreen_project: EVERGREEN_PROJECT
           evergreen_commit: ${{ env.commit }}
 
-      - uses: $/upload-s3-assets
+      - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
         with:
           version: ${{ env.package_version }}
           product_name: RELEASE_PACKAGE
@@ -102,7 +103,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Node and dependencies
-        uses: $/node/setup
+        uses: mongodb-labs/drivers-github-tools/node/setup@v3
 
       - run: npm publish --provenance --tag=RELEASE_TAG
         if: ${{ needs.release_please.outputs.release_created }}

From 07edfdbcf2a1f5dfcc2b5512c5582beff0fbcc45 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 11:16:19 -0500
Subject: [PATCH 14/18] DRIVERS-3596 Strip maintenance comment from generated
 release workflows

---
 node/generate_release.mjs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/node/generate_release.mjs b/node/generate_release.mjs
index 7246f97..29009b9 100644
--- a/node/generate_release.mjs
+++ b/node/generate_release.mjs
@@ -19,7 +19,10 @@ const isNative =
 const template = readFileSync(
   join(__dirname, "./release_template.yml"),
   "utf-8",
-);
+)
+  .split("\n")
+  .filter((line) => !line.startsWith("# This is a template rendered into consumer repos"))
+  .join("\n");
 
 const EVERGREEN_PROJECTS = {
   mongodb: "mongo-node-driver-next",

From 85def2da86658067d8053a95ff3640909f5b1e61 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 11:21:58 -0500
Subject: [PATCH 15/18] DRIVERS-3596 Add concrete example for sub-action ref
 resolution to README

---
 README.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/README.md b/README.md
index 3cada10..71a9ba4 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,17 @@ action also freezes its internal sub-action dependencies at that same point,
 rather than always picking up the latest tagged version of the sub-action.
 Bump your pin to pick up sub-action updates too.
 
+For example, `full-report/action.yml` internally calls `sbom`, `authorized-pub`,
+`code-scanning-export`, and `compliance-report` through `$/` references. If you
+pin `full-report` to an old sha:
+
+```yaml
+uses: mongodb-labs/drivers-github-tools/full-report@<old-sha>
+```
+
+that pinned `full-report` now uses the version of `sbom` (and its other
+sub-actions) that existed at that same sha, not the latest `v3`-tagged `sbom`.
+
 Example `dependabot.yml`:
 
 ```yaml

From 10d8dcf8b19f82ef4d7161f13503711103df2845 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 13:00:39 -0500
Subject: [PATCH 16/18] DRIVERS-3596 Address PR review: move agent-tooling
 ignores to global gitignore, tighten README wording

---
 .gitignore |  2 --
 README.md  | 48 ++++++++++++++++++------------------------------
 2 files changed, 18 insertions(+), 32 deletions(-)
 delete mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
deleted file mode 100644
index 9b9d131..0000000
--- a/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-.superpowers/
-docs/superpowers/plans/
diff --git a/README.md b/README.md
index 71a9ba4..d30bc7c 100644
--- a/README.md
+++ b/README.md
@@ -10,20 +10,18 @@ See the [How To: Set up Secure Release Process using GitHub Action](https://wiki
 ## Working on Actions
 
 Many of the actions in this repo depend on one another. Internal action-to-action
-references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`).
-`$/` resolves to the repository and ref of the file that contains the reference.
-For an action or workflow that runs in this repo, that means this repo at the
-exact commit currently running, so no version pin or checkout is needed. This
-requires an Actions runner >= 2.336.0 (GitHub-hosted runners satisfy this
-automatically). Use `$/` for any new internal reference instead of a pinned
-`mongodb-labs/drivers-github-tools/...@v3` reference.
-
-The one exception is `node/release_template.yml`. It is not a workflow that runs
-in this repo, it is a template that `node/generate_release.mjs` renders into
-driver repos as their own release workflow. A `$/` reference in that file would
-resolve to the driver repo it ends up living in, not to this repo, so
-`node/release_template.yml` must keep pinned `owner/repo/path@vX` references
-instead of `$/`.
+references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
+which resolves to the repository and ref of the file containing the reference:
+this repo, at the exact commit running, for anything that executes here. No
+version pin or checkout is needed. This requires an Actions runner >= 2.336.0
+(GitHub-hosted runners satisfy this automatically). Use `$/` for any new
+internal reference instead of a pinned `mongodb-labs/drivers-github-tools/...@v3`
+reference.
+
+The one exception is `node/release_template.yml`: it's a template that
+`node/generate_release.mjs` renders into driver repos as their own release
+workflow, so `$/` there would resolve to the driver repo instead of this one.
+It must keep pinned `owner/repo/path@vX` references.
 
 ## Consuming Actions
 
@@ -31,22 +29,12 @@ It is recommended that you use Dependabot and use an explicit reference when
 using these actions.  This will allow Dependabot to update to a more recent sha
 and allow you to accept updates to the actions as needed.
 
-Note that internal sub-action references now resolve to the same ref the
-top-level action was pinned to. This means pinning an old sha of a top-level
-action also freezes its internal sub-action dependencies at that same point,
-rather than always picking up the latest tagged version of the sub-action.
-Bump your pin to pick up sub-action updates too.
-
-For example, `full-report/action.yml` internally calls `sbom`, `authorized-pub`,
-`code-scanning-export`, and `compliance-report` through `$/` references. If you
-pin `full-report` to an old sha:
-
-```yaml
-uses: mongodb-labs/drivers-github-tools/full-report@<old-sha>
-```
-
-that pinned `full-report` now uses the version of `sbom` (and its other
-sub-actions) that existed at that same sha, not the latest `v3`-tagged `sbom`.
+Because `$/` resolves relative to the pinned ref (see "Working on Actions"
+above), pinning an old sha of a top-level action also freezes the sub-actions
+it calls internally at that same point, rather than always picking up their
+latest tagged version. For example, pinning `full-report` to an old sha means
+it also calls that old sha's `sbom`, `authorized-pub`, `code-scanning-export`,
+and `compliance-report`. Bump your pin to pick up sub-action updates too.
 
 Example `dependabot.yml`:
 

From 478c30cea565ba33826e42e223334479a8079701 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 13:52:10 -0500
Subject: [PATCH 17/18] DRIVERS-3596 Remove Actions runner version mention from
 README

---
 README.md | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index d30bc7c..345ffa5 100644
--- a/README.md
+++ b/README.md
@@ -13,10 +13,8 @@ Many of the actions in this repo depend on one another. Internal action-to-actio
 references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
 which resolves to the repository and ref of the file containing the reference:
 this repo, at the exact commit running, for anything that executes here. No
-version pin or checkout is needed. This requires an Actions runner >= 2.336.0
-(GitHub-hosted runners satisfy this automatically). Use `$/` for any new
-internal reference instead of a pinned `mongodb-labs/drivers-github-tools/...@v3`
-reference.
+version pin or checkout is needed. Use `$/` for any new internal reference
+instead of a pinned `mongodb-labs/drivers-github-tools/...@v3` reference.
 
 The one exception is `node/release_template.yml`: it's a template that
 `node/generate_release.mjs` renders into driver repos as their own release

From 1efd754d9f094a260cac38866d85a205e82b9cc6 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Mon, 3 Aug 2026 14:35:17 -0500
Subject: [PATCH 18/18] DRIVERS-3596 Specify Node.js driver repos in
 release_template.yml docs

---
 README.md                 | 6 +++---
 node/generate_release.mjs | 2 +-
 node/release_template.yml | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 345ffa5..32a5a79 100644
--- a/README.md
+++ b/README.md
@@ -17,9 +17,9 @@ version pin or checkout is needed. Use `$/` for any new internal reference
 instead of a pinned `mongodb-labs/drivers-github-tools/...@v3` reference.
 
 The one exception is `node/release_template.yml`: it's a template that
-`node/generate_release.mjs` renders into driver repos as their own release
-workflow, so `$/` there would resolve to the driver repo instead of this one.
-It must keep pinned `owner/repo/path@vX` references.
+`node/generate_release.mjs` renders into Node.js driver repos as their own
+release workflow, so `$/` there would resolve to the driver repo instead of
+this one. It must keep pinned `owner/repo/path@vX` references.
 
 ## Consuming Actions
 
diff --git a/node/generate_release.mjs b/node/generate_release.mjs
index 29009b9..fa98c0d 100644
--- a/node/generate_release.mjs
+++ b/node/generate_release.mjs
@@ -21,7 +21,7 @@ const template = readFileSync(
   "utf-8",
 )
   .split("\n")
-  .filter((line) => !line.startsWith("# This is a template rendered into consumer repos"))
+  .filter((line) => !line.startsWith("# This is a template rendered into"))
   .join("\n");
 
 const EVERGREEN_PROJECTS = {
diff --git a/node/release_template.yml b/node/release_template.yml
index f1281fd..4e2293e 100644
--- a/node/release_template.yml
+++ b/node/release_template.yml
@@ -1,4 +1,4 @@
-# This is a template rendered into consumer repos by generate_release.mjs, so it must keep pinned owner/repo/path@vX references (not $/), since $/ resolves relative to whatever repo the rendered workflow ends up living in, not this repo.
+# This is a template rendered into Node.js driver repos by generate_release.mjs, so it must keep pinned owner/repo/path@vX references (not $/), since $/ resolves relative to whatever repo the rendered workflow ends up living in, not this repo.
 on:
   push:
     branches: [RELEASE_BRANCH]