Use self-repository syntax for local workflow refs

[rdimitrov]

Summary

• Why: GitHub's workspace-relative uses: ./... syntax resolves against runner filesystem state at step-execution time. Any step that runs before it and can write into .github/ is able to substitute the workflow or composite action that a later step executes. That is most relevant in run-on-pr.yml, which executes untrusted pull request code in the tests and skills-build jobs. The ./ form also does not count as a pinned reference for GitHub's actions policy.
• Why: 31 open zizmor/self-repository alerts in the code scanning backlog — every remaining zizmor finding on main.
• What: Rewrote all 31 in-repo uses: references across 6 workflows from ./.github/... to $/.github/..., the syntax GitHub now recommends for same-repository references. It resolves from the repository at the caller's commit, is immune to workspace tampering, and is treated as fully pinned.

No behavior change: $/ and ./ both resolve the called workflow from the same commit as the caller.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)

• E2E tests (task test-e2e)

• Linting (task lint-fix)

• Manual testing (describe below)

• Verified the rewrite is exhaustive and exact: grep -rn "uses: \./" .github/workflows/ returns 0 matches, grep -rn 'uses: \$/' returns 31 — matching the 31 open alerts one-for-one.

• Diff is 31 insertions(+), 31 deletions(-) across 6 files, all single-token prefix changes.

• All workflow YAML re-parses cleanly.

• This PR self-tests the change: it modifies run-on-pr.yml, so the checks on this PR are themselves dispatched through the new $/ references. A green run is direct evidence the syntax resolves.

Changes

File	Change
.github/workflows/run-on-pr.yml	11 reusable-workflow refs → $/
.github/workflows/run-on-main.yml	11 reusable-workflow refs → $/
.github/workflows/releaser.yml	3 reusable-workflow refs → $/
.github/workflows/image-build-and-publish.yml	4 compute-version action refs → $/
.github/workflows/skills-build.yml	1 compute-version action ref → $/
.github/workflows/skills-publish.yml	1 compute-version action ref → $/

Does this introduce a user-facing change?

No.

Special notes for reviewers

Two things I checked that are worth knowing:

1. $/ is not supported on GitHub Enterprise Server. Per GitHub's docs: "This syntax is not available in GitHub Enterprise Server." stacklok/toolhive runs on github.com so this is fine, but it would break a GHES mirror of these workflows.
2. actionlint does not yet recognise $/. Version 1.7.12 reports all 25 reusable-workflow calls as malformed (is not following the format ... [workflow-call]). This does not affect CI — actionlint is not wired into any workflow or Taskfile target — but anyone running it locally will see the noise until upstream adds support.

The 6 compute-version call sites still require actions/checkout to have run, since the composite action shells out to git rev-parse --short HEAD in the workspace. $/ changes only where the action definition is loaded from, not where its steps execute, so those call sites are unaffected.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.97%. Comparing base (e532cf0) to head (904c8e5).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6654      +/-   ##
==========================================
- Coverage   78.98%   78.97%   -0.01%     
==========================================
  Files         782      782              
  Lines       78065    78065              
==========================================
- Hits        61658    61652       -6     
- Misses      16402    16408       +6     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.