fix(security): use self-repository syntax for setup-backend ref in unit-test workflow

Resolves code-scanning alert #2670 zizmor's self-repository audit flags workspace-relative `uses: ./...` references to in-repo actions/workflows in favor of GitHub's dedicated `$/...` self-repository syntax, which resolves the action at the exact commit running the workflow without depending on runtime filesystem state (e.g. an action cloned in a previous step), and is treated as a pinning mechanism by GitHub's own policy enforcement.
2026-09-08 16:25:03 +00:00 · 2026-09-07 12:33:01 -07:00
1 changed files with 1 additions and 1 deletions
@@ -60,7 +60,7 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Python
-        uses: ./.github/actions/setup-backend/
+        uses: $/.github/actions/setup-backend/
        with:
          python-version: ${{ matrix.python-version }}
      - name: Python unit tests