fix(ci): use the self-repository prefix in renovate-automerge

[castrojo]

What does this change?

One-line fix: .github/workflows/renovate-automerge.yml:34 used a workspace-relative uses: ./… where this repo requires the $/ self-repository prefix.

The failure

main is currently red for every PR. Two required checks fail on the same finding:

• Lint GitHub Actions / Check self-repository references
• pytest :: tests/test_self_repository_references.py::test_repository_has_no_invalid_self_references

Invalid caller-workspace self references found:
.github/workflows/renovate-automerge.yml:34: uses: ./.github/workflows/reusable-renovate-automerge.yml

Origin

Introduced by #400 (ci(actions): make mergeraptor auto-merge actually fire on main), confirmed via git log -S 'uses: ./.github/workflows/reusable-renovate-automerge.yml'. (I initially attributed it to #401 in a comment on #405 — that was just the most recent commit on main; #400 is the actual source.)

scripts/check-self-repository-references.py matches ^\s*uses:\s*(?:projectbluefin/actions/|\./) across .github/, actions/, and bootc-build/, so the ./ form is rejected by design. The rule is documented in docs/skills/composite-actions/reusable-workflow.md — $/ resolves from the repository and commit that owns the running workflow, so a reusable workflow called by a consumer cannot accidentally resolve ./ against the consumer's checked-out workspace.

The fix

./ → $/, matching the five other in-repo reusable workflow calls already on main:

• pkg-cadence.yml:22,30
• promote-bluefin-stable.yml:21
• reusable-promote-squash.yml:445
• validate-renovate.yml:20

Nothing else changes: same reusable workflow, same with: inputs, same secrets: block. $/ for reusable workflow calls needs runner ≥ 2.336.0, already satisfied — the five references above are live on main today.

Verification

• python3 scripts/check-self-repository-references.py → Self-repository references use $/. (exit 0)
• python -m pytest tests/test_self_repository_references.py → 3 passed
• actionlint (whole repo) → exit 0 (the $/ parser ignores in .github/actionlint.yaml already cover this form)
• pre-commit run --files .github/workflows/renovate-automerge.yml → all hooks pass

Consumer validation

Not required: consumer-validation.yml only demands evidence for bootc-build/*/action.yml and .github/workflows/reusable-*.yml. This file is neither.

Kept deliberately separate from #405 (the publish_stream_tag stream-tag leak fix) so neither change carries the other's risk.

Checklist

• I am using an agent and I take responsibility for this PR (if AI-assisted)
• Conventional commit message
• No hardcoded secrets or credentials

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None