Refactoring/952 update zizmor and resolve new finding

.github/actions/security-issues/action.yml

@@ -39,7 +39,7 @@ runs:
     - name: Install Python Toolbox / Security tool
       shell: bash
       run: |
-        pip install exasol-toolbox==10.4.0
+        pip install exasol-toolbox==10.5.0
 
     - name: Create Security Issue Report
       shell: bash

.github/workflows/merge-gate-extension.yml

@@ -16,7 +16,7 @@ jobs:
 
   test-python-environment:
     name: Test python-environment Action
-    uses: ./.github/workflows/test-python-environment.yml
+    uses: $/.github/workflows/test-python-environment.yml
     needs:
       - approve-run-slow-tests
     permissions:

.github/workflows/slow-checks.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   build-matrix:
     name: Build Matrix
-    uses: ./.github/workflows/matrix.yml
+    uses: $/.github/workflows/matrix.yml
     with:
       matrix_keys_json: '["python_versions"]'
     permissions:

.github/workflows/test-python-environment.yml

@@ -41,7 +41,7 @@ jobs:
     needs:
       - check-changes
     if: needs.check-changes.outputs.should_run == 'true'
-    uses: ./.github/workflows/matrix.yml
+    uses: $/.github/workflows/matrix.yml
     with:
       matrix_keys_json: '["python_versions"]'
     permissions:
@@ -75,7 +75,7 @@ jobs:
 
       - name: Set up Python & Poetry Environment
         id: set-up-python-and-poetry-environment
-        uses: ./.github/actions/python-environment
+        uses: $/.github/actions/python-environment
         with:
           python-version: "${{ matrix.python-versions }}"
           poetry-version: "2.3.0"

doc/changes/changes_10.5.0.md

@@ -0,0 +1,52 @@
+# 10.5.0 - 2026-08-31
+
+## Summary
+
+This release documents how to discover and use PTB's Nox sessions in the user
+guide, adds an agent skill for PTB work, and removes the unused Modules section
+from the developer guide. It adds project name and version context to SBOM file
+names, updates GitHub Actions workflows to use GitHub's self-repository syntax,
+and updates project dependencies.
+
+## Security Issues
+
+This release fixes vulnerabilities by updating dependencies:
+
+| Dependency   | Vulnerability   | Affected | Fixed in |
+|--------------|-----------------|----------|----------|
+| cryptography | PYSEC-2026-3552 | 49.0.0   | 50.0.0   |
+| pip          | PYSEC-2026-3721 | 26.1.2   | 26.2     |
+
+## Documentation
+
+* #456: Documented how to discover PTB nox sessions in the user guide
+* #933: Added an agent skill for PTB work
+
+## Feature
+
+* #946: Added project name and version context to SBOM file name
+
+## Refactoring
+
+* #934: Removed unused, experimental Nox session `lint:import`
+* #952: Updated zizmor and GitHub Actions workflows to use GitHub's self-repository syntax
+
+## Dependency Updates
+
+### `main`
+
+* Updated dependency `coverage:7.15.2` to `7.16.0`
+* Removed dependency `import-linter:2.13`
+* Updated dependency `mypy:2.3.0` to `2.3.1`
+* Updated dependency `nox:2026.7.11` to `2026.8.17`
+* Updated dependency `pre-commit:4.6.1` to `4.6.2`
+* Updated dependency `pydantic:2.13.4` to `2.13.5`
+* Updated dependency `pylint:4.0.6` to `4.0.8`
+* Updated dependency `pysonar:1.7.0.5143` to `1.8.0.5390`
+* Updated dependency `sphinx-toolbox:4.2.0` to `4.3.0`
+* Updated dependency `typer:0.27.0` to `0.27.2`
+* Updated dependency `zizmor:1.28.0` to `1.30.0`
+
+### `dev`
+
+* Updated dependency `types-pyyaml:6.0.12.20260724` to `6.0.12.20260815`

doc/changes/unreleased.md

@@ -1,20 +1,3 @@
 # Unreleased
 
 ## Summary
-
-This release documents how to discover and use PTB's Nox sessions in the user
-guide, adds an agent skill for PTB work, and removes the unused Modules section
-from the developer guide.
-
-## Documentation
-
-* #456: Documented how to discover PTB nox sessions in the user guide
-* #933: Added an agent skill for PTB work
-
-## Bug Fixes
-
-* #946: Added project name and version context to SBOM file name
-
-## Refactoring
-
-* #934: Removed unused, experimental Nox session `lint:import`

doc/user_guide/features/github_workflows/workflow_variables.rst

@@ -134,6 +134,6 @@ You can consume the additional value in a workflow by passing the relevant
 
     jobs:
       build-matrix:
-        uses: ./.github/workflows/matrix.yml
+        uses: $/.github/workflows/matrix.yml
         with:
           matrix_keys_json: '["extra_matrix_value","computed_matrix_value"]'

exasol/toolbox/templates/github/workflows/cd.yml

@@ -12,15 +12,15 @@ on:
 jobs:
   check-release-tag:
     name: Check Release Tag
-    uses: ./.github/workflows/check-release-tag.yml
+    uses: $/.github/workflows/check-release-tag.yml
     permissions:
       contents: read
 
   build-and-publish:
     needs:
       - check-release-tag
     name: Build & Publish
-    uses: ./.github/workflows/build-and-publish.yml
+    uses: $/.github/workflows/build-and-publish.yml
     permissions:
       contents: write
     secrets:
@@ -29,7 +29,7 @@ jobs:
   (% if custom_workflows["cd-extension"].exists %)
   cd-extension:
     name: Extension
-    uses: ./.github/workflows/cd-extension.yml
+    uses: $/.github/workflows/cd-extension.yml
     needs:
       - check-release-tag
       - build-and-publish
@@ -42,7 +42,7 @@ jobs:
     needs:
       - build-and-publish
     name: Publish Documentation
-    uses: ./.github/workflows/gh-pages.yml
+    uses: $/.github/workflows/gh-pages.yml
     permissions:
       contents: read
       pages: write

exasol/toolbox/templates/github/workflows/ci.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   merge-gate:
     name: Merge Gate
-    uses: ./.github/workflows/merge-gate.yml
+    uses: $/.github/workflows/merge-gate.yml
 (( workflow_passed_secrets("merge-gate") -))
 (( workflow_permissions("merge-gate") ))
   report:
@@ -21,7 +21,7 @@ jobs:
       always() &&
       needs.merge-gate.result != 'skipped' &&
       needs.merge-gate.result != 'cancelled'
-    uses: ./.github/workflows/report.yml
+    uses: $/.github/workflows/report.yml
     secrets:
       (( sonar_token_name )): ${{ secrets.(( sonar_token_name )) }}
     permissions:

exasol/toolbox/templates/github/workflows/fast-tests.yml

@@ -46,7 +46,7 @@ jobs:
 (% if custom_workflows["fast-tests-extension"].exists %)
   fast-tests-extension:
     name: Extension
-    uses: ./.github/workflows/fast-tests-extension.yml
+    uses: $/.github/workflows/fast-tests-extension.yml
 (( workflow_passed_secrets("fast-tests-extension") -))
 (( workflow_permissions("fast-tests-extension") ))
   (% endif %)

exasol/toolbox/templates/github/workflows/merge-gate.yml

@@ -15,13 +15,13 @@ on:
 jobs:
   run-fast-checks:
     name: Fast Checks
-    uses: ./.github/workflows/checks.yml
+    uses: $/.github/workflows/checks.yml
     permissions:
       contents: read
 
   run-fast-tests:
     name: Fast Tests
-    uses: ./.github/workflows/fast-tests.yml
+    uses: $/.github/workflows/fast-tests.yml
     permissions:
       contents: read
 
@@ -30,7 +30,7 @@ jobs:
     needs:
       - run-fast-checks
       - run-fast-tests
-    uses: ./.github/workflows/report.yml
+    uses: $/.github/workflows/report.yml
     secrets:
       (( sonar_token_name )): ${{ secrets.(( sonar_token_name )) }}
     permissions:
@@ -53,13 +53,13 @@ jobs:
     name: Slow Checks
     needs:
       - approve-run-slow-tests
-    uses: ./.github/workflows/slow-checks.yml
+    uses: $/.github/workflows/slow-checks.yml
 (( workflow_passed_secrets("slow-checks") -))
 (( workflow_permissions("slow-checks") ))
   (% if custom_workflows["merge-gate-extension"].exists %)
   merge-gate-extension:
     name: Extension
-    uses: ./.github/workflows/merge-gate-extension.yml
+    uses: $/.github/workflows/merge-gate-extension.yml
 (( workflow_passed_secrets("merge-gate-extension") -))
 (( workflow_permissions("merge-gate-extension") ))
   (% endif %)