ci: fix zizmor findings

.github/workflows/build-push-test.yml

@@ -18,7 +18,7 @@ permissions: {}
 jobs:
   build-push-test-base:
     name: 🍨 base
-    uses: ./.github/workflows/wc-build-push-test.yml
+    uses: $/.github/workflows/wc-build-push-test.yml
     permissions: &build-push-test-permissions
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -54,7 +54,7 @@ jobs:
           - flavor: embedded-rust
             dockerfile: .devcontainer/rust/Dockerfile
             build-embedded-flavor: true
-    uses: ./.github/workflows/wc-build-push-test.yml
+    uses: $/.github/workflows/wc-build-push-test.yml
     secrets:
       TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
       TEST_GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}

.github/workflows/continuous-integration.yml

@@ -15,7 +15,7 @@ permissions: {}
 jobs:
   build-push-test:
     name: Build → Push → Test
-    uses: ./.github/workflows/build-push-test.yml
+    uses: $/.github/workflows/build-push-test.yml
     permissions:
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -33,7 +33,7 @@ jobs:
   dependency-review:
     name: 🔍 Dependency Review
     needs: build-push-test
-    uses: ./.github/workflows/wc-dependency-review.yml
+    uses: $/.github/workflows/wc-dependency-review.yml
     permissions:
       contents: read
       pull-requests: write # is needed by actions/dependency-review-action to write PR summaries
@@ -63,6 +63,6 @@ jobs:
 
   generate-documents:
     name: 📄 Documentation
-    uses: ./.github/workflows/wc-document-generation.yml
+    uses: $/.github/workflows/wc-document-generation.yml
     permissions:
       contents: read

.github/workflows/image-cleanup.yml

@@ -6,6 +6,10 @@ on:
     - cron: "0 0 * * 3"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/issue-cleanup.yml

@@ -5,6 +5,10 @@ on:
   schedule:
     - cron: "30 1 * * *"
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/issue-creation-tool-versions.yml

@@ -6,6 +6,10 @@ on:
     - cron: 0 0 1 */3 *
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/ossf-scorecard.yml

@@ -9,6 +9,10 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/pr-conventional-title.yml

@@ -8,6 +8,10 @@ on:
       - edited
       - synchronize
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/pr-image-cleanup.yml

@@ -5,6 +5,10 @@ on:
   pull_request:
     types: [closed]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/pr-report.yml

@@ -5,6 +5,10 @@ on:
   pull_request:
     types: [closed]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/release-build.yml

@@ -16,7 +16,7 @@ jobs:
   build-push-test:
     name: Build → Push → Test
     if: ${{ !startsWith(github.ref_name, 'actions/') }}
-    uses: ./.github/workflows/build-push-test.yml
+    uses: $/.github/workflows/build-push-test.yml
     permissions:
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -130,14 +130,14 @@ jobs:
   publish-devcontainer-templates:
     name: 📝 Publish templates
     if: ${{ !startsWith(github.ref_name, 'actions/') }}
-    uses: ./.github/workflows/wc-publish-templates.yml
+    uses: $/.github/workflows/wc-publish-templates.yml
     permissions:
       packages: write # is needed by devcontainers/action to write templates as OCI artifacts
 
   generate-documents:
     name: 📄 Documentation
     if: ${{ !startsWith(github.ref_name, 'actions/') }}
-    uses: ./.github/workflows/wc-document-generation.yml
+    uses: $/.github/workflows/wc-document-generation.yml
     with:
       is-release: true
     permissions:

.github/workflows/update-dependencies.yml

@@ -7,6 +7,10 @@ on:
     - cron: "30 2 * * 0"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/vulnerability-scan.yml

@@ -6,6 +6,10 @@ on:
     - cron: "30 2 * * *"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/wc-build-push-test.yml

@@ -129,7 +129,7 @@ permissions: {}
 jobs:
   build-push:
     name: 🛠️
-    uses: ./.github/workflows/wc-build-push.yml
+    uses: $/.github/workflows/wc-build-push.yml
     permissions:
       actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
       artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -158,7 +158,7 @@ jobs:
     name: 🧪
     if: ${{ inputs.integration-test-file }}
     needs: build-push
-    uses: ./.github/workflows/wc-integration-test-docker.yml
+    uses: $/.github/workflows/wc-integration-test-docker.yml
     permissions:
       contents: read
     secrets: *docker-secrets
@@ -175,7 +175,7 @@ jobs:
     name: 🧪
     if: ${{ inputs.integration-test-file && inputs.integration-test-podman }}
     needs: build-push
-    uses: ./.github/workflows/wc-integration-test-podman.yml
+    uses: $/.github/workflows/wc-integration-test-podman.yml
     permissions:
       contents: read
     secrets: *docker-secrets
@@ -185,7 +185,7 @@ jobs:
     name: 🏗️
     if: ${{ inputs.acceptance-test-devcontainer-file && inputs.acceptance-test-path }}
     needs: build-push
-    uses: ./.github/workflows/wc-acceptance-test.yml
+    uses: $/.github/workflows/wc-acceptance-test.yml
     permissions:
       contents: read
     secrets:

.github/workflows/wc-build-push.yml

@@ -64,7 +64,7 @@ permissions: {}
 jobs:
   sanitize-image-name:
     name: 🧼
-    uses: ./.github/workflows/wc-sanitize-image-name.yml
+    uses: $/.github/workflows/wc-sanitize-image-name.yml
     with:
       image-name: ${{ inputs.image-name }}
       registry: ${{ inputs.registry }}