GitHub Actions Self-Repository Syntax: Reference Your Own Actions at the Running Commit

What shipped#

On July 30, GitHub shipped self-repository references for GitHub Actions: a uses: value that starts with $/ now resolves to the workflow's own repository at the exact commit that is running, with no checkout required.

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Run the repo's own action
        uses: $/.github/actions/deploy-helpers

The new syntax works everywhere the workspace-relative ./ syntax works: workflow steps, composite action steps, nested composition, and reusable workflow calls. It is available on github.com and requires the Actions runner to be on version 2.336.0 or newer. It is not available on GitHub Enterprise Server, per the docs.

Before this release, referencing an action defined in your own repository meant choosing between two flawed options. The ./ path is relative to the checkout location, so it silently breaks when a caller checks the repository out somewhere else, and it forces an extra actions/checkout step. The {owner}/{repo}@{ref} form requires hardcoding a version, which becomes a maintenance burden the moment the action changes - and it quietly defeats commit SHA pinning, because a pinned SHA stays frozen at an old version while an unpinned ref drifts.

Why it matters#

The key property of $/ is that the reference tracks the ref you are already running. If a caller pins your workflow to a full-length commit SHA, your workflow's internal $/ references resolve to that same SHA, not to whatever happens to be on main today. That consistency is what makes the feature more than a convenience:

• No checkout step needed. A $/ reference points into the runner's copy of the repository at the running commit.
• Sibling actions stay in lockstep. An action and the workflow that calls it can never disagree about which commit they are on, even across forks and pinned callers.
• Enterprise policy becomes satisfiable. GitHub's enterprise policy that requires actions to be pinned to a full-length commit SHA was effectively impossible to honor for a repository's own actions, since pinning your own action meant the version never updated. With $/, a workflow that calls its own actions can be pinned to a full SHA and still use the current versions of everything inside that commit.

The changelog positions $/ as the recommended way to compose actions and reusable workflows within a repository, which is a notable change in tone: GitHub is now steering same-repo composition away from the checkout-dependent ./ idiom.

My take#

This is a small change that removes a real footgun, and it matters most for the repos that need it least - the ones with a single workflow file and a couple of steps. The pain compounds at the level where composable actions and reusable workflows actually live: monorepos with a composite action per service, shared lint/deploy workflows called by dozens of child repos, and internal Action catalogs. For those, $/ turns "which version of my own action am I running?" from a question into a definition.

The security angle is the sharpest part. Supply-chain hardening for Actions has focused on third-party references, and deservedly so: the dependency graph, Dependabot alerts for Actions, and SHA-pinning guidance all target actions/checkout@... style references. But same-repository references had an unfixable tension: pin your own action and you freeze it, don't pin it and you violate the policy. Self-repository syntax dissolves that tension instead of papering over it. That is the same class of fix we wrote about in Agent Config Files Are Executable Supply Chain - the moment a file becomes executable config, versioning it correctly becomes a security decision, and the tooling has to make the correct choice the easy one.

It also fits the pattern of GitHub slowly rebuilding its developer surface around workflows, from the spec-kit and gstack push we covered in Spec-Driven Agent Workflows to stacked pull requests reaching public preview on the same day. Reusable workflows are the unit of composition that agents increasingly call, and a reference that is guaranteed to match the running commit removes an entire class of "works in prod, fails in CI" mysteries.

Caveats, in the interest of honesty:

• The runner version floor (2.336.0) matters for self-hosted fleets. An old runner silently treats $/ as an unknown reference, so roll the runner upgrade before the workflow change.
• GHES users do not get this, so polyglot orgs running both platforms still need the ./ or {owner}/{repo}@{ref} forms somewhere.
• The feature only helps when your actions are in the same repository as the workflow. Cross-org internal reuse still needs {owner}/{repo}@{ref} with a real pinning strategy.

The workflow-as-code direction is the right one, and consistent references are the foundation it needed. If you maintain composite actions or reusable workflows, migrating the internal uses: lines to $/ is a small diff that removes a recurring class of supply-chain confusion.

Continue Reading#

• Spec-Driven Agent Workflows: GitHub Spec Kit, gstack, and the New Handoff Layer
• Agent Config Files Are Executable Supply Chain
• Agent Workflows as Code: Why State Machines Beat Prompt Checklists
• GitHub Stacked PRs Hit Public Preview
• Codex SDK vs CLI vs GitHub Action: Which Surface Should You Build On?

Sources#

• Reference same-repository actions with self-repository syntax - GitHub Changelog
• Using pre-written building blocks in your workflow - GitHub Docs
• Workflow syntax for GitHub Actions - GitHub Docs
• Enforcing policies for GitHub Actions in your enterprise - GitHub Docs