fix(ci): run local helpers from workspace

.github/actions/get-msrv/action.yml

@@ -29,7 +29,4 @@ runs:
     - name: Get MSRV
       id: get-msrv
       shell: bash
-      run: |
-        msrv=$(grep '^rust-version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
-        echo "msrv=$msrv" >> $GITHUB_OUTPUT
-        echo "MSRV is $msrv"
+      run: bash "$GITHUB_ACTION_PATH/run.sh"

.github/actions/get-msrv/run.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+set -euo pipefail
+
+msrv=$(grep '^rust-version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
+echo "msrv=$msrv" >> "$GITHUB_OUTPUT"
+echo "MSRV is $msrv"

.github/actions/overwrite-package-version/action.yml

@@ -24,18 +24,8 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Install toml-cli
-      # Avoid `--locked` as its lock file is not recently updated,
-      # and its dependencies at the time rely on unstable nightly features since removed.
-      run: cargo install toml-cli
-      shell: bash
-
-    - name: Set pyproject version
+    - name: Update package version
       shell: bash
       env:
         VERSION: ${{ inputs.version }}
-      run: |
-        echo "Setting pyproject version to: ${VERSION}"
-        PYPROJECT="bindings/python/pyproject.toml"
-        toml set "$PYPROJECT" project.version "${VERSION}" > tmp.toml && mv tmp.toml "$PYPROJECT"
-        sed 's/dynamic = \["version"\]/dynamic = []/' "$PYPROJECT" > tmp.toml && mv tmp.toml "$PYPROJECT"
+      run: bash "$GITHUB_ACTION_PATH/run.sh"

.github/actions/overwrite-package-version/run.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+set -euo pipefail
+
+# Avoid `--locked` as toml-cli's lock file is not recently updated,
+# and its dependencies at the time rely on removed nightly features.
+cargo install toml-cli
+
+echo "Setting pyproject version to: ${VERSION}"
+pyproject="bindings/python/pyproject.toml"
+toml set "$pyproject" project.version "${VERSION}" > tmp.toml
+mv tmp.toml "$pyproject"
+sed 's/dynamic = \["version"\]/dynamic = []/' "$pyproject" > tmp.toml
+mv tmp.toml "$pyproject"

.github/actions/setup-builder/action.yml

@@ -25,24 +25,8 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Setup specified Rust toolchain
-      if: ${{ inputs.rust-version != '' }}
+    - name: Setup Rust toolchain
       shell: bash
       env:
         RUST_VERSION: ${{ inputs.rust-version }}
-      run: |
-        echo "Installing ${RUST_VERSION}"
-        rustup toolchain install ${RUST_VERSION}
-        rustup override set ${RUST_VERSION}
-        rustup component add rustfmt clippy
-    - name: Setup Rust toolchain according to rust-toolchain.toml
-      shell: bash
-      if: ${{ inputs.rust-version == '' }}
-      run: |
-        echo "Installing toolchain according to rust-toolchain.toml"
-        rustup show
-        rustup component add rustfmt clippy
-    - name: Fixup git permissions
-      # https://github.com/actions/checkout/issues/766
-      shell: bash
-      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      run: bash "$GITHUB_ACTION_PATH/run.sh"

.github/actions/setup-builder/run.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+set -euo pipefail
+
+if [[ -n "${RUST_VERSION:-}" ]]; then
+  echo "Installing ${RUST_VERSION}"
+  rustup toolchain install "${RUST_VERSION}"
+  rustup override set "${RUST_VERSION}"
+else
+  echo "Installing toolchain according to rust-toolchain.toml"
+  rustup show
+fi
+
+rustup component add rustfmt clippy
+
+# https://github.com/actions/checkout/issues/766
+git config --global --add safe.directory "$GITHUB_WORKSPACE"

.github/workflows/asf-allowlist-check.yml

@@ -39,9 +39,4 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
-    # The allowlist checker recognizes ./, but not $/, as a local action prefix.
-    # Normalize its disposable checkout while preserving $/ in source workflows.
-    - name: Normalize self-repository references for the allowlist checker
-      run: |
-        find .github -type f -name '*.yml' -exec sed -i 's#uses: \$/#uses: ./#g' {} +
     - uses: apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # allowlist-check/v1.0.0

.github/workflows/audit.yml

@@ -53,9 +53,10 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
-        with:
-          rust-version: stable
+        shell: bash
+        env:
+          RUST_VERSION: stable
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/bindings_python_ci.yml

@@ -85,7 +85,8 @@ jobs:
       # Linux maturin builds may run inside manylinux Docker, so host Rust caches only help Windows/macOS.
       - name: Setup Rust toolchain
         if: runner.os != 'Linux'
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
       - name: Cache Rust artifacts
         if: runner.os != 'Linux'
         uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

.github/workflows/ci.yml

@@ -52,7 +52,8 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - name: Install lint tools
         # Keep versions in sync with the local install targets in Makefile.
@@ -93,7 +94,8 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - name: Cargo clippy
         run: make check-clippy
@@ -117,7 +119,8 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - name: Cache Rust artifacts
         uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -138,7 +141,8 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - name: Cache Rust artifacts
         uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -173,7 +177,8 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - name: Cache Rust artifacts
         uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -202,7 +207,8 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - name: Cache Rust artifacts
         uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -249,12 +255,15 @@ jobs:
           persist-credentials: false
       - name: Get MSRV
         id: get-msrv
-        uses: $/.github/actions/get-msrv
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/get-msrv/run.sh"
       - name: Setup MSRV Rust toolchain
-        uses: $/.github/actions/setup-builder
-        with:
-          rust-version: ${{ steps.get-msrv.outputs.msrv }}
+        shell: bash
+        env:
+          RUST_VERSION: ${{ steps.get-msrv.outputs.msrv }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
       - name: Setup Nightly Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
       - name: Check MSRV
         run: make check-msrv

.github/workflows/public-api.yml

@@ -41,7 +41,8 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - name: Cache Rust artifacts
         uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

.github/workflows/publish.yml

@@ -43,12 +43,14 @@ jobs:
 
       - name: Get MSRV
         id: get-msrv
-        uses: $/.github/actions/get-msrv
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/get-msrv/run.sh"
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
-        with:
-          rust-version: ${{ steps.get-msrv.outputs.msrv }}
+        shell: bash
+        env:
+          RUST_VERSION: ${{ steps.get-msrv.outputs.msrv }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
         id: auth

.github/workflows/release_python.yml

@@ -120,10 +120,12 @@ jobs:
           # Convert semver RC (0.9.0-rc.1) to PEP 440 (0.9.0rc1)
           echo "pep440=$(echo "$CARGO_VERSION" | sed 's/-rc\.\([0-9]*\)/rc\1/')" >> $GITHUB_OUTPUT
 
-      - uses: $/.github/actions/overwrite-package-version
+      - name: Overwrite package version
         if: ${{ needs.validate-release-tag.outputs.is-rc == 'true' }}
-        with:
-          version: ${{ steps.version.outputs.pep440 }}
+        shell: bash
+        env:
+          VERSION: ${{ steps.version.outputs.pep440 }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/overwrite-package-version/run.sh"
 
       - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
@@ -167,22 +169,26 @@ jobs:
           # Convert semver RC (0.9.0-rc.1) to PEP 440 (0.9.0rc1)
           echo "pep440=$(echo "$CARGO_VERSION" | sed 's/-rc\.\([0-9]*\)/rc\1/')" >> $GITHUB_OUTPUT
 
-      - uses: $/.github/actions/overwrite-package-version
+      - name: Overwrite package version
         if: ${{ needs.validate-release-tag.outputs.is-rc == 'true' }}
-        with:
-          version: ${{ steps.version.outputs.pep440 }}
+        shell: bash
+        env:
+          VERSION: ${{ steps.version.outputs.pep440 }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/overwrite-package-version/run.sh"
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.12
       - name: Get MSRV
         id: get-msrv
-        uses: $/.github/actions/get-msrv
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/get-msrv/run.sh"
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
-        with:
-          rust-version: ${{ steps.get-msrv.outputs.msrv }}
+        shell: bash
+        env:
+          RUST_VERSION: ${{ steps.get-msrv.outputs.msrv }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
       - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           target: ${{ matrix.target }}

.github/workflows/release_python_nightly.yml

@@ -53,9 +53,11 @@ jobs:
           CURRENT=$(cargo metadata --format-version 1 --no-deps -q | jq -r '.packages[0].version')
           echo "pep440=${CURRENT}.dev${TIMESTAMP}" >> $GITHUB_OUTPUT
 
-      - uses: $/.github/actions/overwrite-package-version
-        with:
-          version: ${{ steps.version.outputs.pep440 }}
+      - name: Overwrite package version
+        shell: bash
+        env:
+          VERSION: ${{ steps.version.outputs.pep440 }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/overwrite-package-version/run.sh"
 
       - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
@@ -99,22 +101,26 @@ jobs:
           CURRENT=$(cargo metadata --format-version 1 --no-deps -q | jq -r '.packages[0].version')
           echo "pep440=${CURRENT}.dev${TIMESTAMP}" >> $GITHUB_OUTPUT
 
-      - uses: $/.github/actions/overwrite-package-version
-        with:
-          version: ${{ steps.version.outputs.pep440 }}
+      - name: Overwrite package version
+        shell: bash
+        env:
+          VERSION: ${{ steps.version.outputs.pep440 }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/overwrite-package-version/run.sh"
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.12
 
       - name: Get MSRV
         id: get-msrv
-        uses: $/.github/actions/get-msrv
+        shell: bash
+        run: bash "$GITHUB_WORKSPACE/.github/actions/get-msrv/run.sh"
 
       - name: Setup Rust toolchain
-        uses: $/.github/actions/setup-builder
-        with:
-          rust-version: ${{ steps.get-msrv.outputs.msrv }}
+        shell: bash
+        env:
+          RUST_VERSION: ${{ steps.get-msrv.outputs.msrv }}
+        run: bash "$GITHUB_WORKSPACE/.github/actions/setup-builder/run.sh"
 
       - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with: