DRIVERS-3596 Adopt GitHub Actions self-repository syntax for internal action references

.github/workflows/update-action-tag.yml

@@ -30,7 +30,7 @@ jobs:
           persist-credentials: true
 
       - name: Setup
-        uses: ./setup
+        uses: $/setup
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
@@ -43,7 +43,7 @@ jobs:
           git push origin ":v${VERSION}" || true
 
       - name: Create a new signed tag
-        uses: ./git-sign
+        uses: $/git-sign
         with:
           command: git tag -a "v${{ env.VERSION }}" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
 

.github/workflows/zizmor.yml

@@ -21,4 +21,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

CONTRIBUTING.md

@@ -28,5 +28,8 @@ pre-commit run --all-files --hook-stage manual shellcheck
 
 To bump the version tag, run the "Update Tag" [workflow](https://github.com/mongodb-labs/drivers-github-tools/actions/workflows/update-action-tag.yml).
 
-To change the major version, update `.github/workflows/version.txt` and all references to `mongodb-labs/drivers-github-tools`
-in the repo.
+To change the major version, update `.github/workflows/version.txt`. Internal
+action-to-action references use `$/` and do not need updating on a version bump.
+Update the example `mongodb-labs/drivers-github-tools/...@vX` references in
+`README.md` and `node/release_template.yml`, both of which document or use the
+tag external consumers should pin to.

README.md

@@ -9,17 +9,31 @@ See the [How To: Set up Secure Release Process using GitHub Action](https://wiki
 
 ## Working on Actions
 
-Many of the actions in this repo depend on one another.  There is no supported way to reference
-another action using a relative path.  Therefore the recommended approach is to
-set all of the relative actions to your branch name while working on a feature,
-then reverting to the version tag before merging.
+Many of the actions in this repo depend on one another. Internal action-to-action
+references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
+which resolves to the repository and ref of the file containing the reference:
+this repo, at the exact commit running, for anything that executes here. No
+version pin or checkout is needed. Use `$/` for any new internal reference
+instead of a pinned `mongodb-labs/drivers-github-tools/...@v3` reference.
+
+The one exception is `node/release_template.yml`: it's a template that
+`node/generate_release.mjs` renders into Node.js driver repos as their own
+release workflow, so `$/` there would resolve to the driver repo instead of
+this one. It must keep pinned `owner/repo/path@vX` references.
 
 ## Consuming Actions
 
 It is recommended that you use Dependabot and use an explicit reference when
 using these actions.  This will allow Dependabot to update to a more recent sha
 and allow you to accept updates to the actions as needed.
 
+Because `$/` resolves relative to the pinned ref (see "Working on Actions"
+above), pinning an old sha of a top-level action also freezes the sub-actions
+it calls internally at that same point, rather than always picking up their
+latest tagged version. For example, pinning `full-report` to an old sha means
+it also calls that old sha's `sbom`, `authorized-pub`, `code-scanning-export`,
+and `compliance-report`. Bump your pin to pick up sub-action updates too.
+
 Example `dependabot.yml`:
 
 ```yaml

bump-version/action.yml

@@ -36,7 +36,7 @@ runs:
         export COMMIT_MESSAGE=$(echo "${{ inputs.commit_template }}" | envsubst)
         echo "COMMIT_MESSAGE=$COMMIT_MESSAGE" >> $GITHUB_ENV
     - name: Commit the version bump
-      uses: mongodb-labs/drivers-github-tools/git-sign@v3
+      uses: $/git-sign
       with:
         command: |-
           git commit -a -m "${{ env.COMMIT_MESSAGE }}" ${{ env.GPG_PUBLIC_URL != '' && format('-m "PGP-Signing-Key: {0}"', env.GPG_PUBLIC_URL) || '' }} -s --gpg-sign=${{ env.GPG_KEY_ID }}

create-branch/action.yml

@@ -39,7 +39,7 @@ runs:
         RELEASE_WORKFLOW_PATH: ${{ inputs.release_workflow_path }}
         EVERGREEN_PROJECT: ${{ inputs.evergreen_project }}
       run: ${{ github.action_path }}/create-branch.sh
-    - uses: mongodb-labs/drivers-github-tools/bump-version@v3
+    - uses: $/bump-version
       with:
         version: ${{ inputs.version }}
         version_bump_script: ${{ inputs.version_bump_script }}

full-report/action.yml

@@ -36,7 +36,7 @@ runs:
   using: composite
   steps:
     - name: Generate Authorized Publication Report
-      uses: mongodb-labs/drivers-github-tools/authorized-pub@v3
+      uses: $/authorized-pub
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ inputs.release_version }}
@@ -45,18 +45,18 @@ runs:
     - name: Generate SBOM File
       # not all packages have third party dependencies, and so not all packages produce sboms.
       if: ${{ inputs.sbom_in_path }}
-      uses: mongodb-labs/drivers-github-tools/sbom@v3
+      uses: $/sbom
       with:
         sbom_file_name: ${{ inputs.sbom_file_name }}
         kondukto_sub_project: ${{ inputs.kondukto_sub_project }}
         sbom_in_path: ${{ inputs.sbom_in_path }}
     - name: Generate Sarif File
-      uses: mongodb-labs/drivers-github-tools/code-scanning-export@v3
+      uses: $/code-scanning-export
       with:
         ref: ${{ inputs.sarif_report_target_ref || inputs.release_version }}
         output-file: ${{ env.S3_ASSETS }}/code-scanning-alerts.json
     - name: Generate Compliance Report
-      uses: mongodb-labs/drivers-github-tools/compliance-report@v3
+      uses: $/compliance-report
       with:
         release_version: ${{ inputs.release_version }}
         security_report_location: ${{ inputs.security_report_location }}

golang/pre-publish/action.yml

@@ -17,14 +17,14 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: mongodb-labs/drivers-github-tools/bump-version@v3
+    - uses: $/bump-version
       with:
         version: ${{ inputs.version }}
         version_bump_script: "go run ${{ github.action_path }}/bump-version.go"
         commit_template: "BUMP v${VERSION}"
         # Never push commit, we still need to merge up if a push is requested
         push_commit: false
-    - uses: mongodb-labs/drivers-github-tools/tag-version@v3
+    - uses: $/tag-version
       with:
         version: v${{ inputs.version }}
         push_tag: ${{ inputs.push_changes }}

golang/publish/action.yml

@@ -24,7 +24,7 @@ runs:
       shell: bash
       run: |
         echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-    - uses: mongodb-labs/drivers-github-tools/full-report@v3
+    - uses: $/full-report
       with:
         product_name: mongo-go-driver
         release_version: ${{ inputs.version }}
@@ -43,7 +43,7 @@ runs:
         GH_TOKEN: ${{ inputs.token }}
       run: ./publish.sh
     - name: Upload S3 assets
-      uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+      uses: $/upload-s3-assets
       with:
           version: ${{ inputs.version }}
           product_name: mongo-go-driver

node/generate_release.mjs

@@ -19,7 +19,10 @@ const isNative =
 const template = readFileSync(
   join(__dirname, "./release_template.yml"),
   "utf-8",
-);
+)
+  .split("\n")
+  .filter((line) => !line.startsWith("# This is a template rendered into"))
+  .join("\n");
 
 const EVERGREEN_PROJECTS = {
   mongodb: "mongo-node-driver-next",

node/release_template.yml

@@ -1,3 +1,4 @@
+# This is a template rendered into Node.js driver repos by generate_release.mjs, so it must keep pinned owner/repo/path@vX references (not $/), since $/ resolves relative to whatever repo the rendered workflow ends up living in, not this repo.
 on:
   push:
     branches: [RELEASE_BRANCH]

node/sign_node_package/action.yml

@@ -42,12 +42,12 @@ runs:
         mkdir ${{ inputs.artifact_directory }}
 
     - name: Load version and package info
-      uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
+      uses: $/node/get_version_info
       with:
         npm_package_name: ${{ inputs.npm_package_name }}
 
     - name: Set up drivers-github-tools
-      uses: mongodb-labs/drivers-github-tools/setup@v3
+      uses: $/setup
       with:
         aws_region_name: ${{ inputs.aws_region_name }}
         aws_role_arn: ${{ inputs.aws_role_arn }}
@@ -70,7 +70,7 @@ runs:
         echo "FILES_TO_SIGN=${FILENAMES}" >> "$GITHUB_ENV"
 
     - name: Create detached signature
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: ${{ env.FILES_TO_SIGN }}
       env:

python-labs/post-publish/action.yml

@@ -73,7 +73,7 @@ runs:
         git clean -dffx
         git pull origin ${GITHUB_REF}
     - name: Set following version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: inputs.dry_run == 'false'
       with:
           version: ${{ steps.publish-script.outputs.following_version }}

python-labs/pre-publish/action.yml

@@ -55,7 +55,7 @@ runs:
         echo "VERSION=$VERSION" >> $GITHUB_ENV
         rm -rf dist
     - name: Tag version
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       with:
         version: ${{ env.VERSION }}
         tag_template: ${{ inputs.tag_template }}

python/post-publish/action.yml

@@ -70,15 +70,15 @@ runs:
           echo "VERSION=$VERSION" >> $GITHUB_ENV
         fi
     - name: Create detached signature for dist files
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: dist/*
     - name: Get the evergreen commit
       id: evergreen-commit
       shell: bash
       run: |
         echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-    - uses: mongodb-labs/drivers-github-tools/full-report@v3
+    - uses: $/full-report
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ env.VERSION }}
@@ -89,7 +89,7 @@ runs:
         evergreen_project: ${{ inputs.evergreen_project }}
         evergreen_commit: ${{ steps.evergreen-commit.outputs.commit }}
         token: ${{ inputs.token }}
-    - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+    - uses: $/upload-s3-assets
       with:
           version: ${{ env.VERSION }}
           product_name: ${{ inputs.product_name }}
@@ -124,7 +124,7 @@ runs:
         git clean -dffx
         git pull origin ${GITHUB_REF}
     - name: Set following version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: inputs.dry_run == 'false'
       with:
           version: ${{ steps.publish-script.outputs.following_version }}

python/pre-publish/action.yml

@@ -65,15 +65,15 @@ runs:
           echo "VERSION=$VERSION" >> $GITHUB_ENV
         fi
     - name: Set version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: ${{ inputs.version }}
       with:
         version: ${{ env.VERSION }}
         version_bump_script: ${{ inputs.version_bump_script }}
         working_directory: ${{ inputs.working_directory }}
         push_commit: ${{ env.PUSH_CHANGES }}
     - name: Tag version
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       with:
         version: ${{ env.VERSION }}
         tag_template: ${{ inputs.tag_template }}

ruby/build/action.yml

@@ -34,7 +34,7 @@ runs:
   using: composite
   steps:
     - name: Check out the repository
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}

ruby/cleanup/action.yml

@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: 'Check out the repository'
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}

ruby/publish/action.yml

@@ -57,7 +57,7 @@ runs:
   using: composite
   steps:
     - name: Check out the repository
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}
@@ -80,7 +80,7 @@ runs:
       run: echo "version=$(bundle exec rake version)" >> "$GITHUB_OUTPUT"
 
     - name: Setup GitHub tooling for DBX Drivers
-      uses: mongodb-labs/drivers-github-tools/setup@v3
+      uses: $/setup
       with:
         aws_role_arn: ${{ inputs.aws_role_arn }}
         aws_region_name: ${{ inputs.aws_region_name }}
@@ -94,12 +94,12 @@ runs:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     - name: Sign the gems
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: '*.gem'
 
     - name: Generate SSDLC Reports
-      uses: mongodb-labs/drivers-github-tools/full-report@v3
+      uses: $/full-report
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ steps.release_version.outputs.version }}
@@ -122,7 +122,7 @@ runs:
         fi
 
     - name: Create the tag
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       if: steps.tag_exists.outputs.exists == 'false'
       with:
         version: ${{ steps.release_version.outputs.version }}
@@ -176,7 +176,7 @@ runs:
       run: gh release upload --clobber v${RELEASE_VERSION} *.gem ${RELEASE_ASSETS}/*.sig
 
     - name: Upload S3 assets
-      uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+      uses: $/upload-s3-assets
       with:
         version: ${{ steps.release_version.outputs.version }}
         product_name: ${{ inputs.product_id }}

tag-version/action.yml

@@ -33,7 +33,7 @@ runs:
         export TAG_MESSAGE=$(echo "${{ inputs.tag_message_template }}" | envsubst)
         echo "TAG_MESSAGE=$TAG_MESSAGE" >> $GITHUB_ENV
     - name: Tag the version
-      uses: mongodb-labs/drivers-github-tools/git-sign@v3
+      uses: $/git-sign
       with:
         command: |-
           git tag -a "${{ env.TAG }}" -m "${{ env.TAG_MESSAGE }}" ${{ env.GPG_PUBLIC_URL != '' && format('-m "PGP-Signing-Key: {0}"', env.GPG_PUBLIC_URL) || '' }} -s --local-user=${{ env.GPG_KEY_ID }}