ci: finish migrating Platform automation

.github/workflows/ci.yaml

@@ -4163,7 +4163,7 @@ jobs:
           fi
 
       - name: 📊 Evaluate job results
-        uses: devantler-tech/actions/aggregate-job-checks@ea4df9004d4ab43b6c9af5b0c5f55712f7211328 # v13.10.12
+        uses: devantler-tech/.github/actions/aggregate-job-checks@0c7b6c3509b73adbc7537e030935bb01987e625b # v7.23.0
         with:
           job-results: >-
             ${{ needs.changes.result }}

.github/workflows/release.yaml

@@ -9,7 +9,7 @@ permissions: {}
 
 jobs:
   release:
-    uses: devantler-tech/actions/.github/workflows/create-release.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328 # v13.10.12
+    uses: devantler-tech/.github/.github/workflows/create-release.yaml@0c7b6c3509b73adbc7537e030935bb01987e625b # v7.23.0
     with:
       disable-issue-side-effects: true
     permissions:

.github/workflows/todos.yaml

@@ -10,6 +10,6 @@ permissions:
 
 jobs:
   todos:
-    uses: devantler-tech/actions/.github/workflows/scan-for-todo-comments.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328 # v13.10.12
+    uses: devantler-tech/.github/.github/workflows/scan-for-todo-comments.yaml@0c7b6c3509b73adbc7537e030935bb01987e625b # v7.23.0
     secrets:
       APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/update-skills.yaml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: devantler-tech/actions/.github/workflows/update-agent-skills.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328 # v13.10.12
+    uses: devantler-tech/.github/.github/workflows/update-agent-skills.yaml@0c7b6c3509b73adbc7537e030935bb01987e625b # v7.23.0
     with:
       dir: .agents/skills
       # These are development skills our own agents use, not skills the platform publishes.

scripts/tests/test-guard-deploy-waits-for-merge-group-validators.sh

@@ -128,7 +128,7 @@ consumer_fixture_wiring() {
     --arg suite_run $'bash scripts/tests/test-guard-consumer-discovery-conservation.sh\n' \
     --arg production_run $'shellcheck -x scripts/guard-consumer-discovery-conservation.sh\nshellcheck scripts/tests/test-guard-consumer-discovery-conservation.sh\n./scripts/guard-consumer-discovery-conservation.sh\n' '
       [.jobs["ci-required-checks"].steps[]
-        | select((.uses // "") | startswith("devantler-tech/actions/aggregate-job-checks@"))] as $aggregates
+        | select((.uses // "") | startswith("devantler-tech/.github/actions/aggregate-job-checks@"))] as $aggregates
       | .jobs[$job] as $suite
       | (($suite | type) == "object")
       and ($suite["runs-on"] == "ubuntu-latest")
@@ -202,9 +202,9 @@ ablate_wiring "removing the deployment dependency is refused" \
 ablate_wiring "removing the required-check dependency is refused" \
   '.jobs["ci-required-checks"].needs -= ["validate-consumer-discovery"]'
 ablate_wiring "removing the aggregated fixture result is refused" \
-  '(.jobs["ci-required-checks"].steps[] | select((.uses // "") | test("^devantler-tech/actions/aggregate-job-checks@")).with["job-results"]) |= sub("needs.validate-consumer-discovery.result", "needs.changes.result")'
+  '(.jobs["ci-required-checks"].steps[] | select((.uses // "") | test("^devantler-tech/[.]github/actions/aggregate-job-checks@")).with["job-results"]) |= sub("needs.validate-consumer-discovery.result", "needs.changes.result")'
 ablate_wiring "an unrelated action cannot mask a missing aggregated fixture result" \
-  '(.jobs["ci-required-checks"].steps[] | select((.uses // "") | test("^devantler-tech/actions/aggregate-job-checks@")).with["job-results"]) |= sub("needs.validate-consumer-discovery.result", "needs.changes.result") | .jobs["ci-required-checks"].steps += [{"uses": "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1", "with": {"job-results": "needs.validate-consumer-discovery.result"}}]'
+  '(.jobs["ci-required-checks"].steps[] | select((.uses // "") | test("^devantler-tech/[.]github/actions/aggregate-job-checks@")).with["job-results"]) |= sub("needs.validate-consumer-discovery.result", "needs.changes.result") | .jobs["ci-required-checks"].steps += [{"uses": "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1", "with": {"job-results": "needs.validate-consumer-discovery.result"}}]'
 ablate_wiring "removing both dependencies cannot hide the fixture job" \
   '.jobs["deploy-prod"].needs -= ["validate-consumer-discovery"] | .jobs["ci-required-checks"].needs -= ["validate-consumer-discovery"]'
 ablate_wiring "replacing the full fixture command with success is refused" \

scripts/validate-eks-ci-role-policy/main_test.go

@@ -1537,7 +1537,7 @@ func TestWorkflowValidatesAuthorizationBeforeMergeGroupDeploy(t *testing.T) {
 	aggregators := 0
 	for _, value := range steps {
 		step, _ := value.(map[string]any)
-		if !strings.HasPrefix(fmt.Sprint(step["uses"]), "devantler-tech/actions/aggregate-job-checks@") {
+		if !strings.HasPrefix(fmt.Sprint(step["uses"]), "devantler-tech/.github/actions/aggregate-job-checks@") {
 			continue
 		}
 		aggregators++