This is an automated email from the ASF dual-hosted git repository. rusackas pushed a commit to branch fix/security-self-repository-playwright-testdata in repository https://gitbox.apache.org/repos/asf/superset.git
commit cf5f1635209df62c3afd59715ff6f48a90a55ce7 Author: rusackas <[email protected]> AuthorDate: Wed Sep 9 04:41:56 2026 -0700 fix(security): suppress zizmor self-repository false positive for playwright test-data step cached-dependencies is a git submodule (not a plain directory), so the $/ self-repository syntax can't resolve it during the Import test data step of superset-playwright.yml. Keep the ./ form with a scoped zizmor suppression, consistent with the fix already applied to other occurrences of this action (#43972). Resolves code-scanning alert #2646. Co-Authored-By: Claude Sonnet 5 <[email protected]> --- .github/workflows/superset-playwright.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/superset-playwright.yml b/.github/workflows/superset-playwright.yml index 37675ca150d..01c2c9ae3a0 100644 --- a/.github/workflows/superset-playwright.yml +++ b/.github/workflows/superset-playwright.yml @@ -115,7 +115,13 @@ jobs: with: run: setup-postgres - name: Import test data - uses: ./.github/actions/cached-dependencies + # cached-dependencies is a submodule (not a plain directory), and + # the $/ self-repository syntax resolves action files directly from + # the repository without performing a real (submodule-aware) + # checkout, so it can't see into a submodule's link. Keep this one + # on the workspace-relative ./ form, consistent with every other + # workflow in the repo that references this action. + uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here with: run: playwright_testdata - name: Setup Node.js
