This is an automated email from the ASF dual-hosted git repository. rusackas pushed a commit to branch fix/revert-self-repository-syntax-asf-allowlist in repository https://gitbox.apache.org/repos/asf/superset.git
commit e19f87d24a90b5a4d8f3617b9353a3b10d056fef Author: Claude Code <[email protected]> AuthorDate: Tue Sep 8 10:13:44 2026 -0700 fix(ci): revert self-repository syntax refs the ASF allowlist check can't see yet #43844 added a required ASF Allowlist Check (apache/infrastructure-actions' allowlist-check) that scans every `uses:` ref under .github/ and fails the build if it isn't on the ASF-approved allowlist. Its skip logic only recognizes the legacy `./` local-action prefix: SKIPPED_PREFIXES = ("./", "docker://") It has no notion of GitHub's newer `$/` self-repository syntax, so the three local composite-action refs previously migrated to `$/` by #43969 (change-detector, setup-backend, setup-supersetbot) get misclassified as external actions needing ASF allowlist approval, and the check hard-fails on every PR that touches .github/** (and on every push to master that does), regardless of what the PR actually changes. Revert those three refs back to `./` so the check passes again. This reintroduces zizmor's advisory (non-blocking; --no-exit-codes) self-repository finding for the same three lines, which is an acceptable trade against a hard-failing required check. hainenber has already opened the real fix upstream: apache/infrastructure-actions#1254 (teach the allowlist check to recognize $/ refs). Once that merges, these three refs can be re-migrated to $/ syntax. Verified locally by running check_asf_allowlist.py from apache/infrastructure-actions against the current .github/ tree: 37/37 action refs now pass ("All 37 unique action refs are on the ASF allowlist"), where it previously reported these same 3 files' 5 refs as not allowlisted. Co-Authored-By: Claude Sonnet 5 <[email protected]> --- .github/workflows/superset-translations.yml | 6 +++--- .github/workflows/supersetbot.yml | 2 +- .github/workflows/tag-release.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/superset-translations.yml b/.github/workflows/superset-translations.yml index a8a0d61b7cc..3b09a1eedd9 100644 --- a/.github/workflows/superset-translations.yml +++ b/.github/workflows/superset-translations.yml @@ -32,7 +32,7 @@ jobs: - name: Check for file changes id: check - uses: $/.github/actions/change-detector/ + uses: ./.github/actions/change-detector/ with: token: ${{ secrets.GITHUB_TOKEN }} @@ -74,13 +74,13 @@ jobs: - name: Check for file changes id: check - uses: $/.github/actions/change-detector/ + uses: ./.github/actions/change-detector/ with: token: ${{ secrets.GITHUB_TOKEN }} - name: Setup Python if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true' - uses: $/.github/actions/setup-backend/ + uses: ./.github/actions/setup-backend/ - name: Install gettext tools if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true' diff --git a/.github/workflows/supersetbot.yml b/.github/workflows/supersetbot.yml index 8f6cb587c7c..09817762670 100644 --- a/.github/workflows/supersetbot.yml +++ b/.github/workflows/supersetbot.yml @@ -46,7 +46,7 @@ jobs: persist-credentials: false - name: Setup supersetbot - uses: $/.github/actions/setup-supersetbot/ + uses: ./.github/actions/setup-supersetbot/ - name: Execute custom Node.js script env: diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml index 0c1a0c4c4a0..3b62041e60c 100644 --- a/.github/workflows/tag-release.yml +++ b/.github/workflows/tag-release.yml @@ -81,7 +81,7 @@ jobs: package-manager-cache: false - name: Setup supersetbot - uses: $/.github/actions/setup-supersetbot + uses: ./.github/actions/setup-supersetbot - name: Execute custom Node.js script env:
