[ci] Update 3 actions in 3 workflows (#17748)

* Bump docker/setup-qemu-action v4.2.0 => v4.4.0
* Bump github/codeql-action v4.37.7 => v4.38.2
* Bump zizmorcore/zizmor-action v0.6.2 => v0.6.4
* Use self-repository syntax in reusable workflow calls

Authored by: bashonly, dlp-bot

Co-authored-by: bashonly <bashonly@protonmail.com>

.github/actionlint.yml

@@ -22,3 +22,15 @@ paths:
     ignore:
       # https://github.com/rhysd/actionlint/issues/657
       - 'unexpected key "queue" for "concurrency" section.+'
+  .github/workflows/release-master.yml:
+    ignore:
+      # https://github.com/rhysd/actionlint/issues/711
+      - 'reusable workflow call .+ at "uses" is not following the format.+'
+  .github/workflows/release-nightly.yml:
+    ignore:
+      # https://github.com/rhysd/actionlint/issues/711
+      - 'reusable workflow call .+ at "uses" is not following the format.+'
+  .github/workflows/release.yml:
+    ignore:
+      # https://github.com/rhysd/actionlint/issues/711
+      - 'reusable workflow call .+ at "uses" is not following the format.+'

.github/workflows/build.yml

@@ -265,7 +265,7 @@ jobs:
 
       - name: Set up QEMU
         if: matrix.qemu_platform
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4.4.0
         with:
           image: tonistiigi/binfmt:qemu-v10.0.4-56@sha256:30cc9a4d03765acac9be2ed0afc23af1ad018aed2c28ea4be8c2eb9afe03fbd1
           cache-image: false

.github/workflows/codeql.yml

@@ -36,12 +36,12 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
       with:
         languages: ${{ matrix.language }}
         build-mode: none
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/release-master.yml

@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: write  # May be needed to publish release
       id-token: write  # Needed for trusted publishing
-    uses: ./.github/workflows/release.yml
+    uses: $/.github/workflows/release.yml
     with:
       prerelease: true
       source: ${{ (github.repository != 'yt-dlp/yt-dlp' && vars.MASTER_ARCHIVE_REPO) || 'master' }}

.github/workflows/release-nightly.yml

@@ -77,7 +77,7 @@ jobs:
     permissions:
       contents: write  # May be needed to publish release
       id-token: write  # Needed for trusted publishing
-    uses: ./.github/workflows/release.yml
+    uses: $/.github/workflows/release.yml
     with:
       prerelease: true
       source: ${{ (github.repository != 'yt-dlp/yt-dlp' && vars.NIGHTLY_ARCHIVE_REPO) || 'nightly' }}

.github/workflows/release.yml

@@ -155,7 +155,7 @@ jobs:
     needs: [prepare]
     permissions:
       contents: read
-    uses: ./.github/workflows/build.yml
+    uses: $/.github/workflows/build.yml
     with:
       version: ${{ needs.prepare.outputs.version }}
       channel: ${{ needs.prepare.outputs.channel }}

.github/workflows/test-workflows.yml

@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482  # v0.6.4
         with:
           advanced-security: false
           persona: pedantic