github: Fix code scanning alerts (#305)

* github: Use new self-repository syntax

* github: Suppress dangerous-triggers error for sync_github_issues_to_azdo.yml

* github: Update gh-action-pypi-publish to v1.14.3

Author: bkeryan

.github/workflows/CI.yml

@@ -13,13 +13,13 @@ permissions: {}
 jobs:
   check_nitypes:
     name: Check nitypes
-    uses: ./.github/workflows/check_nitypes.yml
+    uses: $/.github/workflows/check_nitypes.yml
   check_docs:
     name: Check docs
-    uses: ./.github/workflows/check_docs.yml
+    uses: $/.github/workflows/check_docs.yml
   check_workflows:
     name: Check workflows
-    uses: ./.github/workflows/check_workflows.yml
+    uses: $/.github/workflows/check_workflows.yml
     permissions:
       security-events: write
   checks_succeeded:
@@ -30,15 +30,15 @@ jobs:
       - run: exit 0
   run_unit_tests:
     name: Run unit tests
-    uses: ./.github/workflows/run_unit_tests.yml
+    uses: $/.github/workflows/run_unit_tests.yml
     needs: [checks_succeeded]
   run_unit_tests_oldest_deps:
     name: Run unit tests (oldest deps)
-    uses: ./.github/workflows/run_unit_tests_oldest_deps.yml
+    uses: $/.github/workflows/run_unit_tests_oldest_deps.yml
     needs: [checks_succeeded]
   report_test_results:
     name: Report test results
-    uses: ./.github/workflows/report_test_results.yml
+    uses: $/.github/workflows/report_test_results.yml
     needs: [run_unit_tests, run_unit_tests_oldest_deps]
     if: always()
     permissions:

.github/workflows/PR.yml

@@ -17,7 +17,7 @@ permissions: {}
 jobs:
   run_ci:
     name: Run CI
-    uses: ./.github/workflows/CI.yml
+    uses: $/.github/workflows/CI.yml
     permissions:
       contents: read
       checks: write

.github/workflows/publish.yml

@@ -35,10 +35,10 @@ permissions: {}
 jobs:
   check_nitypes:
     name: Check nitypes
-    uses: ./.github/workflows/check_nitypes.yml
+    uses: $/.github/workflows/check_nitypes.yml
   check_docs:
     name: Check docs
-    uses: ./.github/workflows/check_docs.yml
+    uses: $/.github/workflows/check_docs.yml
   build_nitypes:
     name: Build nitypes
     runs-on: ubuntu-latest
@@ -83,7 +83,7 @@ jobs:
         path: dist/
     - run: ls -lR
     - name: Upload to ${{ env.environment }}
-      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
       with:
         repository-url: ${{ fromJson(env.environment-info)[env.environment].upload-url }} 
   update_version:

.github/workflows/sync_github_issues_to_azdo.yml

@@ -5,7 +5,7 @@ on:
     # Omit "labeled" and "unlabeled" to work around https://github.com/danhellem/github-actions-issue-to-work-item/issues/70
     types:
       [opened, edited, deleted, closed, reopened, assigned]
-  issue_comment:
+  issue_comment: # zizmor: ignore[dangerous-triggers] # does not checkout repo or run any code other than danhellem/github-actions-issue-to-work-item
     types: [created, edited, deleted]
 
 permissions: {}