vatsrahul1001 opened a new pull request, #73057: URL: https://github.com/apache/airflow/pull/73057
After the ruff/mypy static-check restore (#73046), the 3.3.2 sync PR #72946 still had one static-check failure: zizmor's **online** `ref-version-mismatch` audit on `.github/workflows/asf-allowlist-check.yml`. The `apache/infrastructure-actions/allowlist-check` action was pinned to a hash carrying a `# main` comment — a branch, not a version — which the audit flags. (Local/offline zizmor runs miss this; it only surfaces in CI's online run, which is why #73046 shipped with it still red.) Fix: pin to the released `allowlist-check/v1.0.0` tag, matching `main` (backport of the relevant line from #70623 "Pin apache/infrastructure-actions to its released tags"). Verified with the prek zizmor hook run online (`GH_TOKEN=… prek run zizmor --all-files`): **Passed**. This was the last static-check failure blocking a clean 3.3.2rc1 sync PR. ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.8) Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
