This is an automated email from the ASF dual-hosted git repository. rusackas pushed a commit to branch fix/security-zizmor-self-repository-setup-backend in repository https://gitbox.apache.org/repos/asf/superset.git
commit 90eeb527ad83813f8330aeb8db48c7a25ec6993b Author: rusackas <[email protected]> AuthorDate: Tue Sep 8 11:20:32 2026 -0700 fix(security): suppress zizmor self-repository false positive for setup-backend step zizmor's self-repository rule suggests replacing the workspace-relative `./.github/actions/setup-backend/` ref with GitHub's newer `$/` syntax. That migration currently breaks the required apache/infrastructure-actions asf-allowlist-check, which only recognizes the legacy `./` prefix and hard-fails on any `$/` ref (see #44014). Keep `./` with a scoped, justified suppression until apache/infrastructure-actions#1254 teaches the allowlist check about `$/` refs. Resolves code-scanning alert #2659. Co-Authored-By: Claude Sonnet 5 <[email protected]> --- .github/workflows/superset-python-integrationtest.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml index 28e5c34567a..3efd2740546 100644 --- a/.github/workflows/superset-python-integrationtest.yml +++ b/.github/workflows/superset-python-integrationtest.yml @@ -210,7 +210,13 @@ jobs: persist-credentials: false submodules: recursive - name: Setup Python - uses: ./.github/actions/setup-backend/ + # The required apache/infrastructure-actions asf-allowlist-check only + # recognizes the legacy workspace-relative `./` prefix for in-repo + # actions; it misclassifies GitHub's newer `$/` self-repository + # syntax as an external action and hard-fails the build (see #44014). + # Keep `./` here until apache/infrastructure-actions#1254 (teach the + # allowlist check to recognize `$/` refs) merges upstream. + uses: ./.github/actions/setup-backend/ # zizmor: ignore[self-repository] - $/ syntax breaks the required ASF allowlist check until infrastructure-actions#1254 merges - name: Install dependencies uses: ./.github/actions/cached-dependencies with:
