fix(ci): run local helpers from workspace

[manuzhang]

Which issue does this PR close?

• None. This fixes CI startup failures observed on feat(spec): add unknown primitive type support #2773.

What changes are included in this PR?

Invoke the repository's three small CI helpers as shell entrypoints under $GITHUB_WORKSPACE instead of loading them through uses: $/.... The self-repository form resolves through the running commit and intermittently failed to find action metadata for a synthetic pull-request merge commit. Running the checked-out helpers avoids that separate action download.

Keep the composite action interfaces as thin wrappers around the same entrypoints so their logic remains defined in one place. This also avoids returning to uses: ./..., which zizmor 1.30's self-repository audit intentionally rejects.

Remove the allowlist workflow's $/ normalization step because the source workflows no longer contain same-repository uses: references.

Are these changes tested?

• actionlint 1.7.11 against all workflow files.
• zizmor 1.30.0 with CI's exact flags (no findings; 44 existing suppressions).
• bash -n against all three helper entrypoints.
• Exercised MSRV output, both Rust setup branches, and Python version propagation with mocked side-effecting commands.
• git diff --check.

No Rust tests were run because this changes CI orchestration only.

AI Disclosure

OpenAI Codex was used to implement and validate this CI change and prepare the pull request.

[Copilot]

🟢 Approval recommended

All reviewed workflow changes are consistent, and no unresolved issues were identified.

Pull request overview

Updates GitHub Actions to resolve local actions from the checked-out workspace, preventing CI startup failures on synthetic pull-request merge commits.

Changes:

• Replaced $/ action references with ./ workspace-relative paths.
• Removed obsolete allowlist workflow normalization.

File summaries

File	Description
.github/workflows/release_python.yml	Updates release action paths.
.github/workflows/release_python_nightly.yml	Updates nightly release action paths.
.github/workflows/publish.yml	Updates publishing action paths.
.github/workflows/public-api.yml	Updates builder action path.
.github/workflows/ci.yml	Updates CI action paths.
.github/workflows/bindings_python_ci.yml	Updates Python CI action path.
.github/workflows/audit.yml	Updates audit action path.
.github/workflows/asf-allowlist-check.yml	Removes obsolete normalization.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kevinjqliu]

Thanks @manuzhang. Closing this one since the failure turned out to be deterministic rather than intermittent: #3189 added .github export-ignore, and $/ references resolve from the repo archive, so every run after that commit failed at action resolution. #3193 fixed that on main and CI is green again.

If we still want to move off $/, I'd rather do it through zizmor config (allow uses: ./ and revert the #3161 swap) than wrap the actions in scripts, but that's a separate discussion.