Update dependencies and use self-repository syntax

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+  .github/workflows/*.yml:
+    ignore:
+      # https://github.com/rhysd/actionlint/issues/711
+      - 'specifying action "\$/.+" in invalid format because ref is missing'

.github/workflows/pr.yml

@@ -40,7 +40,7 @@ jobs:
             '{ecosystem: "archive", name: "smoke", version: "1.0"}' \
             >release-catalog-smoke/package-identity.json
       - name: Run release catalog dispatch smoke test
-        uses: ./release-catalog
+        uses: $/release-catalog
         env:
           SHARED_ACTIONS_REPO: ${{ github.event.pull_request.head.repo.full_name }}
           SHARED_ACTIONS_REF: ${{ github.event.pull_request.head.sha }}

.github/workflows/test-artifact-cleanup.yml

@@ -26,4 +26,4 @@ jobs:
           name: telemetry-tools-attrs-1234
           path: file.txt
       - name: Clean up telemetry intermediary artifacts
-        uses: ./telemetry-impls/clean-up-artifacts
+        uses: $/telemetry-impls/clean-up-artifacts

.pre-commit-config.yaml

@@ -21,26 +21,26 @@ repos:
       - id: check-yaml
       - id: end-of-file-fixer
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.28.0
+    rev: v1.30.1
     hooks:
       - id: zizmor
   - repo: https://github.com/rhysd/actionlint
     rev: v1.7.12
     hooks:
       - id: actionlint-docker
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.0
+    rev: v0.16.10
     hooks:
       - id: ruff-check
         args: ["--fix", "--config=pyproject.toml"]
       - id: ruff-format
         args: ["--config=pyproject.toml"]
   - repo: https://github.com/rapidsai/pre-commit-hooks
-    rev: v1.6.1
+    rev: v1.7.0
     hooks:
       - id: verify-copyright
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 'v2.3.0'
+    rev: 'v2.4.0'
     hooks:
       - id: mypy
         additional_dependencies:
@@ -51,7 +51,7 @@ repos:
           - "check_nightly_success/"
         pass_filenames: false
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.11.0.1
+    rev: v0.11.0.1-1
     hooks:
       - id: shellcheck
   - repo: https://github.com/adrienverge/yamllint
@@ -60,7 +60,7 @@ repos:
       - id: yamllint
         additional_dependencies: [pyyaml]
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.37.2
+    rev: 0.38.2
     hooks:
       - id: check-jsonschema
         name: validate release catalog config schema fixtures

build-devcontainer/action.yml

@@ -36,21 +36,21 @@ runs:
 
     - if: runner.environment != 'self-hosted'
       name: Set up QEMU
-      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
     - name: Create docker context
       shell: bash
       run: docker context create builder
 
     - if: runner.environment != 'self-hosted'
       name: Setup docker buildx on github-hosted runners
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       with:
         endpoint: builder
 
     - if: runner.environment == 'self-hosted'
       name: Setup docker buildx on self-hosted runners
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       with:
         buildkitd-config: /etc/buildkit/buildkitd.toml
         buildkitd-flags: --config /etc/buildkit/buildkitd.toml

check_nightly_success/dispatch/action.yml

@@ -33,7 +33,7 @@ runs:
         path: ./shared-actions
         persist-credentials: false
     - name: Run check-nightly-success
-      uses: ./shared-actions/check_nightly_success/check-nightly-success
+      uses: ./shared-actions/check_nightly_success/check-nightly-success # zizmor: ignore[self-repository]
       with:
         repo: ${{ inputs.repo }}
         target-branch: ${{ inputs.target-branch }}

publish-docs/action.yml

@@ -94,7 +94,7 @@ runs:
       shell: bash
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+      uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
       with:
         aws-access-key-id: ${{ inputs.target-aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.target-aws-secret-access-key }}

publish-one-doc/action.yaml

@@ -85,7 +85,7 @@ runs:
       shell: bash
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+      uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
       with:
         aws-access-key-id: ${{ inputs.target-aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.target-aws-secret-access-key }}

telemetry-dispatch-setup/action.yml

@@ -26,7 +26,7 @@ runs:
     - name: Creating folder for job-created telemetry artifacts
       shell: bash
       run: mkdir -p telemetry-artifacts
-    - uses: ./shared-actions/telemetry-impls/github-actions-job-info
+    - uses: ./shared-actions/telemetry-impls/github-actions-job-info # zizmor: ignore[self-repository]
       if: steps.has_base_env_var_artifact.outputs.artifact_found == 'true'
     - shell: bash
       if: steps.has_base_env_var_artifact.outputs.artifact_found == 'true'
@@ -35,7 +35,7 @@ runs:
     # overrides loaded value.
     - name: Set OTEL_SERVICE_NAME from job
       if: steps.has_base_env_var_artifact.outputs.artifact_found == 'true'
-      uses: ./shared-actions/telemetry-impls/set-otel-service-name
+      uses: ./shared-actions/telemetry-impls/set-otel-service-name # zizmor: ignore[self-repository]
     - name: Add attribute metadata beyond the stashed basic stuff
       if: steps.has_base_env_var_artifact.outputs.artifact_found == 'true'
       shell: bash

telemetry-dispatch-stash-base-env-vars/action.yml

@@ -22,4 +22,4 @@ runs:
         path: ./shared-actions
         persist-credentials: false
     - name: Stash base env vars
-      uses: ./shared-actions/telemetry-impls/stash-base-env-vars
+      uses: ./shared-actions/telemetry-impls/stash-base-env-vars # zizmor: ignore[self-repository]

telemetry-dispatch-stash-job-artifacts/action.yml

@@ -14,7 +14,7 @@ runs:
       id: has_base_env_var_artifact
     # Stash current job's OTEL_RESOURCE_ATTRIBUTES and any files in the telemetry-artifacts directory
     - name: Stash job artifacts
-      uses: ./shared-actions/telemetry-impls/stash-job-artifacts
+      uses: ./shared-actions/telemetry-impls/stash-job-artifacts # zizmor: ignore[self-repository]
       if: steps.has_base_env_var_artifact.outputs.artifact_found == 'true'
     - name: Output that setup was skipped if the base env var artifact was not found
       if: steps.has_base_env_var_artifact.outputs.artifact_found == 'false'

telemetry-dispatch-summarize/action.yml

@@ -13,7 +13,7 @@ runs:
   steps:
     - uses: rapidsai/shared-actions/telemetry-impls/load-then-clone@main # zizmor: ignore[unpinned-uses]
       id: has_base_env_var_artifact
-    - uses: ./shared-actions/telemetry-impls/summarize
+    - uses: ./shared-actions/telemetry-impls/summarize # zizmor: ignore[self-repository]
       if: steps.has_base_env_var_artifact.outputs.artifact_found == 'true'
     - if: steps.has_base_env_var_artifact.outputs.artifact_found == 'false'
       shell: bash

telemetry-dispatch-write-summary/action.yml

@@ -28,9 +28,9 @@ runs:
     # This is necessary because this action will generally be run in a job separately from
     # where the env vars are set
     - name: Load base environment variables
-      uses: ./shared-actions/telemetry-impls/load-base-env-vars
+      uses: ./shared-actions/telemetry-impls/load-base-env-vars # zizmor: ignore[self-repository]
     - name: Run summarize action
-      uses: ./shared-actions/telemetry-impls/summarize
+      uses: ./shared-actions/telemetry-impls/summarize # zizmor: ignore[self-repository]
       with:
         cert_concat: ${{ inputs.cert_concat }}
         extra_attributes: ${{ inputs.extra_attributes }}

telemetry-impls/set-otel-service-name/action.yml

@@ -18,7 +18,7 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - uses: ./shared-actions/telemetry-impls/github-actions-job-info
+    - uses: ./shared-actions/telemetry-impls/github-actions-job-info # zizmor: ignore[self-repository]
       id: github-job-info
     - shell: bash
       id: get-job-name

telemetry-impls/stash-base-env-vars/action.yml

@@ -36,4 +36,4 @@ runs:
         name: telemetry-tools-env-vars
         path: telemetry-env-vars
     - name: Re-export env vars so that defaults take effect
-      uses: ./shared-actions/telemetry-impls/load-base-env-vars
+      uses: ./shared-actions/telemetry-impls/load-base-env-vars # zizmor: ignore[self-repository]

telemetry-impls/summarize/action.yml

@@ -15,7 +15,7 @@ runs:
       run: pip install -r './shared-actions/telemetry-impls/summarize/requirements.txt'
       shell: bash
     # Writes JSON file that jobs below consume
-    - uses: ./shared-actions/telemetry-impls/github-actions-job-info
+    - uses: ./shared-actions/telemetry-impls/github-actions-job-info # zizmor: ignore[self-repository]
       id: github-job-info
       with:
         all_jobs: true
@@ -45,7 +45,7 @@ runs:
         ls -lR telemetry-artifacts
         timeout 5m python3 ./shared-actions/telemetry-impls/summarize/send_trace.py
     - name: Clean up attributes artifacts from all jobs
-      uses: ./shared-actions/telemetry-impls/clean-up-artifacts
+      uses: ./shared-actions/telemetry-impls/clean-up-artifacts # zizmor: ignore[self-repository]
 
     - name: Add link in step summary
       shell: bash

telemetry-impls/traceparent/action.yml

@@ -18,11 +18,11 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - uses: ./shared-actions/telemetry-impls/ensure-otel-cli-available
+    - uses: ./shared-actions/telemetry-impls/ensure-otel-cli-available # zizmor: ignore[self-repository]
     # this ensures that OTEL_SERVICE_NAME is either set before this action, or sets it from the github job metadata
-    - uses: ./shared-actions/telemetry-impls/set-otel-service-name
+    - uses: ./shared-actions/telemetry-impls/set-otel-service-name # zizmor: ignore[self-repository]
       if: env.OTEL_SERVICE_NAME == ''
-    - uses: ./shared-actions/telemetry-impls/sanity-checks
+    - uses: ./shared-actions/telemetry-impls/sanity-checks # zizmor: ignore[self-repository]
 
     - shell: bash
       id: output-inputs

trigger-workflow-and-wait/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24.1
+FROM alpine:3.24.2
 
 RUN <<EOF
 apk update