From f32af3e272d1b4cfe18db4f1ebd8e2f299dd150c Mon Sep 17 00:00:00 2001
From: Maarten Zuidhoorn <maarten@zuidhoorn.com>
Date: Thu, 20 Nov 2025 11:20:29 +0100
Subject: [PATCH 1/5] Checkout action using `action_ref`

---
 .github/actions/setup-e2e-env/action.yml      | 11 ++++-
 .github/scripts/create-platform-release-pr.sh | 42 +++++++++----------
 .../test-create-platform-release-pr-full.sh   |  8 ++--
 .github/workflows/changelog-check.yml         | 18 ++++----
 .github/workflows/create-release-pr.yml       | 20 ++++-----
 .github/workflows/flaky-test-report.yml       | 19 +++++----
 .github/workflows/get-release-timelines.yml   | 10 +++--
 .github/workflows/post-merge-validation.yml   | 19 +++++----
 .../publish-slack-release-testing-status.yml  | 20 ++++-----
 .../remove-rca-needed-label-sheets.yml        | 20 ++++-----
 .github/workflows/stable-sync.yml             | 28 ++++---------
 .../workflows/update-release-changelog.yml    | 19 ++++-----
 12 files changed, 109 insertions(+), 125 deletions(-)

diff --git a/.github/actions/setup-e2e-env/action.yml b/.github/actions/setup-e2e-env/action.yml
index c263686a..68181f89 100644
--- a/.github/actions/setup-e2e-env/action.yml
+++ b/.github/actions/setup-e2e-env/action.yml
@@ -89,6 +89,13 @@ runs:
     - run: echo "Setup E2E Environment started"
       shell: bash
 
+    - name: Checkout GitHub tools repository
+      uses: actions/checkout@v5
+      with:
+        repository: ${{ github.action_repository }}
+        ref: ${{ github.action_ref }}
+        path: ./.github-tools
+
     ## Android Setup (early for fail-fast) ##
 
     # Set Android environment variables (self-hosted runner has SDK pre-installed)
@@ -101,7 +108,7 @@ runs:
 
     - name: Configure Android Signing Certificates
       if: ${{ inputs.platform == 'android' && inputs.configure-keystores == 'true' }}
-      uses: MetaMask/github-tools/.github/actions/configure-keystore@0259e8a920318b02a8860e178d79796eaa08de02
+      uses: ./.github-tools/.github/actions/configure-keystore
       with:
         aws-role-to-assume: ${{ inputs.keystore-role-to-assume }}
         aws-region: 'us-east-2'
@@ -178,7 +185,7 @@ runs:
 
     - name: Configure iOS Signing Certificates
       if: ${{ inputs.platform == 'ios' && inputs.configure-keystores == 'true' }}
-      uses: MetaMask/github-tools/.github/actions/configure-keystore@0259e8a920318b02a8860e178d79796eaa08de02
+      uses: ./.github-tools/.github/actions/configure-keystore
       with:
         aws-role-to-assume: ${{ inputs.keystore-role-to-assume }}
         aws-region: 'us-east-2'
diff --git a/.github/scripts/create-platform-release-pr.sh b/.github/scripts/create-platform-release-pr.sh
index 1307f8e1..c1b99b65 100755
--- a/.github/scripts/create-platform-release-pr.sh
+++ b/.github/scripts/create-platform-release-pr.sh
@@ -239,7 +239,7 @@ create_release_pr() {
 
     # Version Updates
     echo "Running version update scripts.."
-    ./github-tools/.github/scripts/set-semvar-version.sh "${new_version}" "${platform}"
+    ./.github-tools/.github/scripts/set-semvar-version.sh "${new_version}" "${platform}"
 
     # Commit Changes
     local changed_files
@@ -273,7 +273,7 @@ create_release_pr() {
     # Prepare release PR body with team sign-off checklist
     local release_body="# 🚀 v${new_version} Testing & Release Quality Process
 
-Hi Team,  
+Hi Team,
 As part of our new **MetaMask Release Quality Process**, here’s a quick overview of the key processes, testing strategies, and milestones to ensure a smooth and high-quality deployment.
 
 ---
@@ -281,34 +281,34 @@ As part of our new **MetaMask Release Quality Process**, here’s a quick overvi
 ## 📋 Key Processes
 
 ### Testing Strategy
-- **Developer Teams:**  
-  Conduct regression and exploratory testing for your functional areas, including automated and manual tests for critical workflows.  
-- **QA Team:**  
-  Focus on exploratory testing across the wallet, prioritize high-impact areas, and triage any Sentry errors found during testing.  
-- **Customer Success Team:**  
+- **Developer Teams:**
+  Conduct regression and exploratory testing for your functional areas, including automated and manual tests for critical workflows.
+- **QA Team:**
+  Focus on exploratory testing across the wallet, prioritize high-impact areas, and triage any Sentry errors found during testing.
+- **Customer Success Team:**
   Validate new functionalities and provide feedback to support release monitoring.
 
 ### GitHub Signoff
-- Each team must **sign off on the Release Candidate (RC)** via GitHub by the end of the validation timeline (**Tuesday EOD PT**).  
+- Each team must **sign off on the Release Candidate (RC)** via GitHub by the end of the validation timeline (**Tuesday EOD PT**).
 - Ensure all tests outlined in the Testing Plan are executed, and any identified issues are addressed.
 
 ### Issue Resolution
-- **Resolve all Release Blockers** (Sev0 and Sev1) by **Tuesday EOD PT**.  
+- **Resolve all Release Blockers** (Sev0 and Sev1) by **Tuesday EOD PT**.
 - For unresolved blockers, PRs may be reverted, or feature flags disabled to maintain release quality and timelines.
 
 ### Cherry-Picking Criteria
-- Only **critical fixes** meeting outlined criteria will be cherry-picked.  
+- Only **critical fixes** meeting outlined criteria will be cherry-picked.
 - Developers must ensure these fixes are thoroughly reviewed, tested, and merged by **Tuesday EOD PT**.
 
 ---
 
 ## 🗓️ Timeline and Milestones
 
-1. **Today (Friday):** Begin Release Candidate validation.  
-2. **Tuesday EOD PT:** Finalize RC with all fixes and cherry-picks.  
-3. **Wednesday:** Buffer day for final checks.  
-4. **Thursday:** Submit release to app stores and begin rollout to 1% of users.  
-5. **Monday:** Scale deployment to 10%.  
+1. **Today (Friday):** Begin Release Candidate validation.
+2. **Tuesday EOD PT:** Finalize RC with all fixes and cherry-picks.
+3. **Wednesday:** Buffer day for final checks.
+4. **Thursday:** Submit release to app stores and begin rollout to 1% of users.
+5. **Monday:** Scale deployment to 10%.
 6. **Tuesday:** Full rollout to 100%.
 
 ---
@@ -320,9 +320,9 @@ Each team is responsible for signing off via GitHub. Use the checkbox below to t
 # Team sign-off checklist
 - [ ] ${platform_team_name}
 
-This process is a major step forward in ensuring release stability and quality. Let’s stay aligned and make this release a success! 🚀  
+This process is a major step forward in ensuring release stability and quality. Let’s stay aligned and make this release a success! 🚀
 
-Feel free to reach out if you have questions or need clarification. 
+Feel free to reach out if you have questions or need clarification.
 
 Many thanks in advance
 
@@ -381,8 +381,8 @@ create_changelog_pr() {
         echo "Previous version is not a recognized release branch pattern. Treating as tag or SHA: ${previous_version_ref}"
       fi
 
-      # Switch to github-tools directory
-      cd ./github-tools/
+      # Switch to .github-tools directory
+      cd ./.github-tools/
       ls -ltra
       corepack prepare yarn@4.5.1 --activate
       # This can't be done from the actions context layer due to the upstream repository having it's own context set with yarn
@@ -401,7 +401,7 @@ create_changelog_pr() {
     #   # Create a new Release Sheet Page for the new version with our commits.csv content
     #   yarn run update-release-sheet "${platform}" "${new_version}" "${GOOGLE_DOCUMENT_ID}" "./commits.csv" "${PROJECT_GIT_DIR}" "${MOBILE_TEMPLATE_SHEET_ID}" "${EXTENSION_TEMPLATE_SHEET_ID}"
     # fi
-    # Note: Only change directories when we actually entered ./github-tools/
+    # Note: Only change directories when we actually entered ./.github-tools/
 
     # Commit and Push Changelog Changes (exclude commits.csv)
     echo "Adding and committing changes.."
@@ -441,7 +441,7 @@ create_version_bump_pr() {
 
     # Update version files on main branch
     echo "Running version update scripts for ${main_branch} branch.."
-    ./github-tools/.github/scripts/set-semvar-version.sh "${next_version}" "${platform}"
+    ./.github-tools/.github/scripts/set-semvar-version.sh "${next_version}" "${platform}"
 
     # Commit version bump changes
     echo "Committing version bump changes.."
diff --git a/.github/scripts/tests/test-create-platform-release-pr-full.sh b/.github/scripts/tests/test-create-platform-release-pr-full.sh
index 9ebf31be..731b134c 100755
--- a/.github/scripts/tests/test-create-platform-release-pr-full.sh
+++ b/.github/scripts/tests/test-create-platform-release-pr-full.sh
@@ -81,12 +81,12 @@ ls() { echo "MOCK: ls $*"; return 0; }
 pwd() { echo "/mock/directory"; return 0; }
 
 # Create mock version script
-mkdir -p ./github-tools/.github/scripts/
-cat > ./github-tools/.github/scripts/set-semvar-version.sh << 'EOF'
+mkdir -p ./.github-tools/.github/scripts/
+cat > ./.github-tools/.github/scripts/set-semvar-version.sh << 'EOF'
 #!/usr/bin/env bash
 echo "MOCK: Version script - Setting $2 to version $1"
 EOF
-chmod +x ./github-tools/.github/scripts/set-semvar-version.sh
+chmod +x ./.github-tools/.github/scripts/set-semvar-version.sh
 
 # Export all mocks
 export -f git gh npx yarn corepack cd ls pwd
@@ -176,7 +176,7 @@ echo "Test version bump: $(get_version_bump_branch_name "2.1.0")"
 echo ""
 echo "5️⃣  CLEANUP"
 echo "==========="
-rm -rf ./github-tools/
+rm -rf ./.github-tools/
 echo "✅ Cleaned up mock files"
 
 echo ""
diff --git a/.github/workflows/changelog-check.yml b/.github/workflows/changelog-check.yml
index 557edb21..fde4a7d1 100644
--- a/.github/workflows/changelog-check.yml
+++ b/.github/workflows/changelog-check.yml
@@ -56,13 +56,13 @@ jobs:
           path: target-repo
           fetch-depth: 0
 
-      - name: Checkout github-tools repository
+      - name: Checkout GitHub tools repository
         if: ${{ steps.label-check.outputs.skip_check != 'true' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          ref: ${{ inputs.action-sha }}
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       - name: Enable Corepack
         if: ${{ steps.label-check.outputs.skip_check != 'true' }}
@@ -73,21 +73,21 @@ jobs:
         if: ${{ steps.label-check.outputs.skip_check != 'true' }}
         uses: actions/setup-node@v4
         with:
-          node-version-file: ./github-tools/.nvmrc
-          cache-dependency-path: ./github-tools/yarn.lock
+          node-version-file: ./.github-tools/.nvmrc
+          cache-dependency-path: ./.github-tools/yarn.lock
           cache: yarn
 
       - name: Install dependencies
         if: ${{ steps.label-check.outputs.skip_check != 'true' }}
         run: yarn --immutable
         shell: bash
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
 
       - name: Check Changelog
         if: ${{ steps.label-check.outputs.skip_check != 'true' }}
         id: changelog-check
         shell: bash
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
         env:
           BASE_BRANCH: ${{ inputs.base-branch || 'main' }}
           PR_NUMBER: ${{ inputs.pr-number }}
diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml
index d0417e52..4039c42c 100644
--- a/.github/workflows/create-release-pr.yml
+++ b/.github/workflows/create-release-pr.yml
@@ -49,10 +49,6 @@ on:
         required: true
         type: string
         description: 'The platform for which the release PR is being created.'
-      github-tools-version:
-        type: string
-        description: 'The version of github-tools to use. Defaults to main.'
-        default: 'main'
       git-user-name:
         type: string
         description: 'Git user name for commits. Defaults to metamaskbot.'
@@ -86,16 +82,16 @@ jobs:
           token: ${{ secrets.github-token }}
 
       # Step 2: Checkout github-tools repository
-      - name: Checkout github-tools repository
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          ref: ${{ inputs.github-tools-version }}
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       # Step 3: Setup environment from github-tools
       - name: Checkout and setup environment
-        uses: ./github-tools/.github/actions/checkout-and-setup
+        uses: ./.github-tools/.github/actions/checkout-and-setup
         with:
           is-high-risk-environment: true
 
@@ -112,7 +108,6 @@ jobs:
           MOBILE_TEMPLATE_SHEET_ID: ${{ inputs.mobile-template-sheet-id }}
           EXTENSION_TEMPLATE_SHEET_ID: ${{ inputs.extension-template-sheet-id }}
           RELEASE_SHEET_GOOGLE_DOCUMENT_ID: ${{ inputs.release-sheet-google-document-id }}
-          GITHUB_TOOLS_VERSION: ${{ inputs.github-tools-version }}
           GIT_USER_NAME: ${{ inputs.git-user-name }}
           GIT_USER_EMAIL: ${{ inputs.git-user-email }}
         run: |
@@ -130,7 +125,6 @@ jobs:
           echo "Mobile Template Sheet ID: $MOBILE_TEMPLATE_SHEET_ID"
           echo "Extension Template Sheet ID: $EXTENSION_TEMPLATE_SHEET_ID"
           echo "Release Sheet Google Document ID: $RELEASE_SHEET_GOOGLE_DOCUMENT_ID"
-          echo "GitHub Tools Version: $GITHUB_TOOLS_VERSION"
           echo "Git User Name: $GIT_USER_NAME"
           echo "Git User Email: $GIT_USER_EMAIL"
           echo "-------------"
@@ -158,7 +152,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: |
           # Execute the script from github-tools
-          ./github-tools/.github/scripts/create-platform-release-pr.sh \
+          ./.github-tools/.github/scripts/create-platform-release-pr.sh \
             "$PLATFORM" \
             "$PREVIOUS_VERSION_REF" \
             "$SEMVER_VERSION" \
diff --git a/.github/workflows/flaky-test-report.yml b/.github/workflows/flaky-test-report.yml
index 1f5c298a..62bac261 100644
--- a/.github/workflows/flaky-test-report.yml
+++ b/.github/workflows/flaky-test-report.yml
@@ -23,25 +23,26 @@ jobs:
   flaky-test-report:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout github-tools repository
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version-file: ./github-tools/.nvmrc
-          cache-dependency-path: ./github-tools/yarn.lock
+          node-version-file: ./.github-tools/.nvmrc
+          cache-dependency-path: ./.github-tools/yarn.lock
           cache: yarn
 
       - name: Enable Corepack
         run: corepack enable
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
 
       - name: Install dependencies
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
         run: yarn --immutable
 
       - name: Run flaky test report script
@@ -50,5 +51,5 @@ jobs:
           WORKFLOW_ID: ${{ inputs.workflow_id }}
           GITHUB_TOKEN: ${{ secrets.github-token }}
           SLACK_WEBHOOK_FLAKY_TESTS: ${{ secrets.slack-webhook-flaky-tests }}
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
         run: node .github/scripts/create-flaky-test-report.mjs
diff --git a/.github/workflows/get-release-timelines.yml b/.github/workflows/get-release-timelines.yml
index 91f5fceb..e7837543 100644
--- a/.github/workflows/get-release-timelines.yml
+++ b/.github/workflows/get-release-timelines.yml
@@ -17,10 +17,12 @@ jobs:
   get-release-timelines:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout the 'github-tools' repository
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: metamask/github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       - name: Get release timelines
         env:
@@ -30,7 +32,7 @@ jobs:
           RUNWAY_APP_ID: ${{ secrets.RUNWAY_APP_ID }}
           RUNWAY_API_KEY: ${{ secrets.RUNWAY_API_KEY }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: .github/scripts/get-release-timelines.sh
+        run: ./.github-tools/.github/scripts/get-release-timelines.sh
 
       - name: Upload artifact release-timelines-${{ inputs.version }}.csv
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/post-merge-validation.yml b/.github/workflows/post-merge-validation.yml
index 750988c4..fb0928c2 100644
--- a/.github/workflows/post-merge-validation.yml
+++ b/.github/workflows/post-merge-validation.yml
@@ -33,29 +33,30 @@ jobs:
   post-merge-validation-tracker:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout github-tools repository
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version-file: ./github-tools/.nvmrc
-          cache-dependency-path: ./github-tools/yarn.lock
+          node-version-file: ./.github-tools/.nvmrc
+          cache-dependency-path: ./.github-tools/yarn.lock
           cache: yarn
 
       - name: Enable Corepack
         run: corepack enable
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
 
       - name: Install dependencies
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
         run: yarn --immutable
 
       - name: Run post-merge-validation script
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
         env:
           SHEET_ID: ${{ inputs.spreadsheet_id }}
           START_HOUR_UTC: ${{ inputs.start_hour_utc }}
diff --git a/.github/workflows/publish-slack-release-testing-status.yml b/.github/workflows/publish-slack-release-testing-status.yml
index c1d29385..d8fbd85a 100644
--- a/.github/workflows/publish-slack-release-testing-status.yml
+++ b/.github/workflows/publish-slack-release-testing-status.yml
@@ -30,29 +30,29 @@ jobs:
       pull-requests: write
     steps:
       # Step 2: Checkout github-tools repository
-      - name: Checkout github-tools repository
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          ref: main
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version-file: ./github-tools/.nvmrc
-          cache-dependency-path: ./github-tools/yarn.lock
+          node-version-file: ./.github-tools/.nvmrc
+          cache-dependency-path: ./.github-tools/yarn.lock
           cache: yarn
 
       - name: Enable Corepack
         run: corepack enable
         shell: bash
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
 
       - name: Install dependencies
         run: yarn --immutable
         shell: bash
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
 
       # Step 4: Run Script
       - name: Publish Slack Release Testing Status
@@ -65,6 +65,6 @@ jobs:
           GOOGLE_APPLICATION_CREDENTIALS_BASE64: ${{ secrets.google-application-creds-base64 }}
           TEST_ONLY: ${{inputs.test-only}}
           PLATFORM: ${{inputs.platform}}
-        working-directory: ./github-tools
+        working-directory: ./.github-tools
         run: |
           yarn run slack:release-testing
diff --git a/.github/workflows/remove-rca-needed-label-sheets.yml b/.github/workflows/remove-rca-needed-label-sheets.yml
index 5a6432f1..0a54bfac 100644
--- a/.github/workflows/remove-rca-needed-label-sheets.yml
+++ b/.github/workflows/remove-rca-needed-label-sheets.yml
@@ -17,11 +17,6 @@ on:
         required: false
         default: 'Form Responses 1'
         type: string
-      github-tools-version:
-        description: 'The version of github-tools to use. Defaults to main.'
-        required: false
-        default: 'main'
-        type: string
     secrets:
       github-token:
         description: 'GitHub token with issues write permissions'
@@ -46,13 +41,12 @@ jobs:
         with:
           token: ${{ secrets.github-token }}
 
-      - name: Checkout github-tools
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          ref: ${{ inputs.github-tools-version }}
-          token: ${{ secrets.github-token }}
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -61,8 +55,8 @@ jobs:
 
       - name: Run RCA Google Sheets check
         run: |
-          # Move to github-tools directory where our script lives
-          cd github-tools/.github/scripts
+          # Move to .github-tools directory where our script lives
+          cd ./.github-tools/.github/scripts
 
           # Create a simple package.json for npm to work with
           echo '{}' > package.json
diff --git a/.github/workflows/stable-sync.yml b/.github/workflows/stable-sync.yml
index 7ecc4131..9c31f7f1 100644
--- a/.github/workflows/stable-sync.yml
+++ b/.github/workflows/stable-sync.yml
@@ -20,11 +20,6 @@ on:
         type: string
         description: 'The name of the stable branch to sync to (e.g., stable, main)'
         default: 'stable'
-      github-tools-version:
-        required: false
-        type: string
-        description: 'The version of github-tools to use. Defaults to main.'
-        default: 'main'
   workflow_call:
     inputs:
       semver-version:
@@ -41,11 +36,6 @@ on:
         type: string
         description: 'The name of the stable branch to sync to (e.g., stable, main)'
         default: 'stable'
-      github-tools-version:
-        required: false
-        type: string
-        description: 'The version of github-tools to use. Defaults to main.'
-        default: ${{ github.action_ref }}
     secrets:
       github-token:
         description: 'GitHub token for creating pull requests'
@@ -59,12 +49,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Checkout github-tools repository
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          ref: ${{ inputs.github-tools-version }}
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       - name: Setup Node.js Mobile
         if: ${{ inputs.repo-type == 'mobile' }}
@@ -116,13 +106,13 @@ jobs:
           SEMVER_VERSION: ${{ inputs.semver-version }}
         run: |
           # Ensure github-tools is in .gitignore to prevent it from being committed
-          if ! grep -q "^github-tools/" .gitignore 2>/dev/null; then
-            echo "github-tools/" >> .gitignore
-            echo "Added github-tools/ to .gitignore"
+          if ! grep -q "^\.github-tools/" .gitignore 2>/dev/null; then
+            echo ".github-tools/" >> .gitignore
+            echo "Added .github-tools/ to .gitignore"
           fi
 
           # Execute the script from github-tools
-          node ./github-tools/.github/scripts/stable-sync.js "stable-main-$SEMVER_VERSION"
+          node ./.github-tools/.github/scripts/stable-sync.js "stable-main-$SEMVER_VERSION"
           BRANCH_NAME="stable-main-$SEMVER_VERSION"
           if git ls-remote --heads origin "$BRANCH_NAME" | grep -q "$BRANCH_NAME"; then
             echo "Branch $BRANCH_NAME exists remotely, force pushing to overwrite"
diff --git a/.github/workflows/update-release-changelog.yml b/.github/workflows/update-release-changelog.yml
index 535b91bb..0a07d004 100644
--- a/.github/workflows/update-release-changelog.yml
+++ b/.github/workflows/update-release-changelog.yml
@@ -21,11 +21,6 @@ on:
         type: string
         default: 'null'
         description: 'Previous release version reference (branch/tag/SHA). Use "null" for hotfixes.'
-      github-tools-version:
-        required: false
-        type: string
-        default: 'main'
-        description: 'Version of github-tools to use (branch, tag, or SHA).'
     secrets:
       github-token:
         required: true
@@ -48,16 +43,16 @@ jobs:
           token: ${{ secrets.github-token }}
 
       # Step 2: Checkout github-tools repository
-      - name: Checkout github-tools repository
-        uses: actions/checkout@v4
+      - name: Checkout GitHub tools repository
+        uses: actions/checkout@v5
         with:
-          repository: MetaMask/github-tools
-          ref: ${{ inputs.github-tools-version }}
-          path: github-tools
+          repository: ${{ github.action_repository }}
+          ref: ${{ github.action_ref }}
+          path: ./.github-tools
 
       # Step 3: Setup environment from github-tools
       - name: Checkout and setup environment
-        uses: ./github-tools/.github/actions/checkout-and-setup
+        uses: ./.github-tools/.github/actions/checkout-and-setup
         with:
           is-high-risk-environment: true
 
@@ -78,7 +73,7 @@ jobs:
           corepack enable
           yarn install --immutable
 
-          ./github-tools/.github/scripts/update-release-changelog.sh \
+          ./.github-tools/.github/scripts/update-release-changelog.sh \
             "$RELEASE_BRANCH" \
             "$PLATFORM" \
             "$REPOSITORY_URL" \

From b0fd4a83bf2a6105cc22d652a0f633d817752ee2 Mon Sep 17 00:00:00 2001
From: Maarten Zuidhoorn <maarten@zuidhoorn.com>
Date: Thu, 20 Nov 2025 11:39:04 +0100
Subject: [PATCH 2/5] Rewrite check-changelog to action

---
 .github/actions/changelog-check/action.yml | 87 ++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 .github/actions/changelog-check/action.yml

diff --git a/.github/actions/changelog-check/action.yml b/.github/actions/changelog-check/action.yml
new file mode 100644
index 00000000..8a3dbba9
--- /dev/null
+++ b/.github/actions/changelog-check/action.yml
@@ -0,0 +1,87 @@
+name: Check Changelog
+
+inputs:
+  action-sha:
+    description: 'The SHA of the action to use'
+    required: true
+  base-branch:
+    description: 'The base branch to compare against'
+    required: false
+    default: 'main'
+  head-ref:
+    description: 'The head ref to check out'
+    required: true
+  labels:
+    description: 'JSON string of PR labels'
+    required: true
+  pr-number:
+    description: 'The pull request number'
+    required: true
+  repo:
+    description: 'The repository to check'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Check PR Labels
+      id: label-check
+      env:
+        PR_LABELS: ${{ inputs.labels }}
+      run: |
+        if echo "$PR_LABELS" | jq -e '.[] | select(.name == "no-changelog")' > /dev/null; then
+          echo "no-changelog label found, skipping changelog check."
+          echo "skip_check=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "No no-changelog label found, proceeding with check."
+          echo "skip_check=false" >> "$GITHUB_OUTPUT"
+        fi
+      shell: bash
+
+    - name: Check out target repository
+      if: ${{ steps.label-check.outputs.skip_check != 'true' }}
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ inputs.repo }}
+        ref: ${{ inputs.head-ref }}
+        path: target-repo
+        fetch-depth: 0
+
+    - name: Checkout GitHub tools repository
+      if: ${{ steps.label-check.outputs.skip_check != 'true' }}
+      uses: actions/checkout@v5
+      with:
+        repository: ${{ github.action_repository }}
+        ref: ${{ github.action_ref }}
+        path: ./.github-tools
+
+    - name: Enable Corepack
+      if: ${{ steps.label-check.outputs.skip_check != 'true' }}
+      run: corepack enable
+      shell: bash
+      working-directory: ./.github-tools
+
+    - name: Set up Node.js
+      if: ${{ steps.label-check.outputs.skip_check != 'true' }}
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: ./.github-tools/.nvmrc
+        cache-dependency-path: ./.github-tools/yarn.lock
+        cache: yarn
+
+    - name: Install dependencies
+      if: ${{ steps.label-check.outputs.skip_check != 'true' }}
+      run: yarn --immutable
+      shell: bash
+      working-directory: ./.github-tools
+
+    - name: Check Changelog
+      if: ${{ steps.label-check.outputs.skip_check != 'true' }}
+      id: changelog-check
+      shell: bash
+      working-directory: ./.github-tools
+      env:
+        BASE_BRANCH: ${{ inputs.base-branch }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+      run: |
+        yarn run changelog:check ../target-repo "$BASE_BRANCH" "$PR_NUMBER"

From caa983d60caeaef88b420e6e2456a581f346597e Mon Sep 17 00:00:00 2001
From: Maarten Zuidhoorn <maarten@zuidhoorn.com>
Date: Thu, 20 Nov 2025 11:40:14 +0100
Subject: [PATCH 3/5] Remove action-sha from inputs

---
 .github/actions/changelog-check/action.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/actions/changelog-check/action.yml b/.github/actions/changelog-check/action.yml
index 8a3dbba9..22be289a 100644
--- a/.github/actions/changelog-check/action.yml
+++ b/.github/actions/changelog-check/action.yml
@@ -1,9 +1,6 @@
 name: Check Changelog
 
 inputs:
-  action-sha:
-    description: 'The SHA of the action to use'
-    required: true
   base-branch:
     description: 'The base branch to compare against'
     required: false

From dd2d882d8cdc94e9d3d55636df05cb22de63f633 Mon Sep 17 00:00:00 2001
From: Maarten Zuidhoorn <maarten@zuidhoorn.com>
Date: Thu, 20 Nov 2025 11:50:45 +0100
Subject: [PATCH 4/5] Add debug log

---
 .github/actions/changelog-check/action.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/actions/changelog-check/action.yml b/.github/actions/changelog-check/action.yml
index 22be289a..600458df 100644
--- a/.github/actions/changelog-check/action.yml
+++ b/.github/actions/changelog-check/action.yml
@@ -44,6 +44,16 @@ runs:
         path: target-repo
         fetch-depth: 0
 
+    - name: Debug log
+      if: ${{ steps.label-check.outputs.skip_check != 'true' }}
+      env:
+        ACTION_REPOSITORY: ${{ github.action_repository }}
+        ACTION_REF: ${{ github.action_ref }}
+      run: |
+          echo "ACTION_REPOSITORY: $ACTION_REPOSITORY"
+          echo "ACTION_REF: $ACTION_REF"
+      shell: bash
+
     - name: Checkout GitHub tools repository
       if: ${{ steps.label-check.outputs.skip_check != 'true' }}
       uses: actions/checkout@v5

From a331f87d15712e9dd9749757ff0c78b0523f8fc9 Mon Sep 17 00:00:00 2001
From: Maarten Zuidhoorn <maarten@zuidhoorn.com>
Date: Thu, 20 Nov 2025 11:55:21 +0100
Subject: [PATCH 5/5] Use inputs

---
 .github/actions/changelog-check/action.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/actions/changelog-check/action.yml b/.github/actions/changelog-check/action.yml
index 600458df..b86fc98b 100644
--- a/.github/actions/changelog-check/action.yml
+++ b/.github/actions/changelog-check/action.yml
@@ -17,6 +17,14 @@ inputs:
   repo:
     description: 'The repository to check'
     required: true
+  github-tools-repository:
+    description: 'The GitHub repository containing the GitHub tools'
+    required: false
+    default: ${{ github.action_repository }}
+  github-tools-ref:
+    description: 'The SHA of the action to use'
+    required: false
+    default: ${{ github.action_ref }}
 
 runs:
   using: composite
@@ -47,8 +55,8 @@ runs:
     - name: Debug log
       if: ${{ steps.label-check.outputs.skip_check != 'true' }}
       env:
-        ACTION_REPOSITORY: ${{ github.action_repository }}
-        ACTION_REF: ${{ github.action_ref }}
+        ACTION_REPOSITORY: ${{ inputs.github-tools-repository }}
+        ACTION_REF: ${{ inputs.github-tools-ref }}
       run: |
           echo "ACTION_REPOSITORY: $ACTION_REPOSITORY"
           echo "ACTION_REF: $ACTION_REF"
@@ -58,8 +66,8 @@ runs:
       if: ${{ steps.label-check.outputs.skip_check != 'true' }}
       uses: actions/checkout@v5
       with:
-        repository: ${{ github.action_repository }}
-        ref: ${{ github.action_ref }}
+        repository: ${{ inputs.github-tools-repository }}
+        ref: ${{ inputs.github-tools-ref }}
         path: ./.github-tools
 
     - name: Enable Corepack