[GromNaN]

DRIVERS-3707

The $/ syntax adopted in #112 (DRIVERS-3596) is rejected by the GitHub Actions runner when it loads a composite action from another repository:

mongodb-labs/drivers-github-tools/<sha>/bump-version/action.yml (Line: 39, Col: 13): Expected format {org}/{repo}[/path]@ref. Actual '$/git-sign'
Error: The template is not valid.

Every consumer of bump-version and tag-version fails, including v3.0.7 and v3.1.1. For example, the mongo-php-driver release workflow fails in the "Prepare release" job (PHPC-2785): https://github.com/mongodb/mongo-php-driver/actions/runs/38699312319/job/116303358527

Going back to mongodb-labs/drivers-github-tools/...@v3 would work, but @v3 is a floating tag. A consumer pinned to a SHA would still run the sub-actions from whatever v3 points to, and every release would need an update. This PR avoids internal uses: references entirely.

• The logic of git-sign, sbom, authorized-pub, bump-version, tag-version, gpg-sign, upload-s3-assets, full-report and node/get_version_info now lives in a script next to the action.yml. The action runs it through github.action_path.
• Composite actions that used another action run its script directly, for example bash "${{ github.action_path }}/../git-sign/git-sign.sh". The script is resolved from the same commit as the calling action, so a SHA pin freezes the whole tree and nothing needs updating on a release.
• open-or-update-pr and compliance-report already had a script, which is now called directly.
• setup and secure-checkout wrap third-party actions (aws-actions/*, actions/create-github-app-token, actions/checkout), so they cannot become scripts. Their steps are inlined in the actions that used them (ruby/* and node/sign_node_package). This duplicates the steps and their SHA pins; it is the part of this PR that needs the closest review.
• All existing action.yml files stay in place with the same inputs, so consumers that use them directly (see the README and node/release_template.yml) are not affected.
• ci.yml and release.yml keep $/, because zizmor requires it for local references in this repository's own workflows.
• The template comment and filter in node/generate_release.mjs and node/release_template.yml are removed, as they only explained the $/ exception.
• README.md, CONTRIBUTING.md and script comments no longer describe $/ as the way to reference internal actions.

Checked:

• shellcheck --severity=warning passes on all scripts, and every action.yml is valid YAML.
• tag-version, upload-s3-assets, gpg-sign, bump-version and full-report were run locally with stubbed docker, gh, aws, git and node. They build the expected commands.

Not checked:

• No real workflow was run, so signing, S3 upload and the AWS login are untested.
• ruby/*, node/sign_node_package, golang/* and python/* were only validated as YAML.

A new patch release is needed after merging so consumers can pick up the fix.

[GromNaN]

This PR is closed because it was based on a wrong assumption: the $/ references do not break the release.

It was opened after the mongo-php-driver release run https://github.com/mongodb/mongo-php-driver/actions/runs/38699312319 (DRIVERS-3707) showed these messages:

bump-version/action.yml (Line: 39, Col: 13): Expected format {org}/{repo}[/path]@ref. Actual '$/git-sign'

The description above says that every consumer of bump-version and tag-version fails. That is not correct. These messages are only annotations, and the job Prepare release concluded with success. In that run the runner still resolved $/git-sign to mongodb-labs/drivers-github-tools/git-sign at the same commit as the calling action. The version bump commit and the tag were signed (git verify-tag reports a good signature), the tag was pushed and the draft release was created.

The annotations come from the runner version of that run, 2.337.0. They are fixed by actions/runner#4669 ("Accept $/ self-repository references in action manifests"), which says it "prevents valid nested self-repository actions from being reported as malformed". It ships in runner v2.338.0. The runs below use 2.338.0 and have no such annotation, while still resolving $/ references inside the actions of this repository:

• mongodb/laravel-mongodb release run 40348736411 (2026-10-26)
• mongodb/mongo-python-driver release runs 40275301100 (2026-10-26) and 40456351328 (2026-10-27)

So the $/ syntax from #112 works as intended, and nothing needs to change in this repository.