This is an automated email from the ASF dual-hosted git repository. rusackas pushed a commit to branch fix/security-self-repository-integrationtest-celery-postgres in repository https://gitbox.apache.org/repos/asf/superset.git
commit 1fc3759f13a3cee4510cad950f80fa2d348a603b Author: rusackas <[email protected]> AuthorDate: Tue Sep 8 14:25:48 2026 -0700 fix(security): suppress zizmor self-repository false positive for postgres celery worker step Resolves code-scanning alert #2658 (zizmor/self-repository) on .github/workflows/superset-python-integrationtest.yml:172. The `Start Celery worker` step in the `test-postgres` job references `.github/actions/cached-dependencies` via the workspace-relative `uses: ./...` form, which zizmor's self-repository audit flags in favor of `uses: $/...`. That rewrite can't be applied here: cached-dependencies is a real git submodule, and $/ resolves action files directly from the repository tree without a submodule-aware checkout, so it can't see past the submodule's gitlink into the actual action.yml. This mirrors the same constraint already documented and suppressed for the other cached-dependencies references in this file and in superset-translations.yml. --- .github/workflows/superset-python-integrationtest.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml index 28e5c34567a..4a3c3986b06 100644 --- a/.github/workflows/superset-python-integrationtest.yml +++ b/.github/workflows/superset-python-integrationtest.yml @@ -169,7 +169,13 @@ jobs: run: | setup-postgres - name: Start Celery worker - uses: ./.github/actions/cached-dependencies + # cached-dependencies is a git submodule (not a plain directory), and + # the $/ self-repository syntax resolves action files directly from + # the repository without performing a real (submodule-aware) + # checkout, so it can't see into a submodule's gitlink. Keep this one + # on the workspace-relative ./ form, consistent with every other + # workflow in the repo that references this action. + uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here with: run: celery-worker - name: Python integration tests (PostgreSQL)
