This is an automated email from the ASF dual-hosted git repository. rusackas pushed a commit to branch fix/security-self-repository-extensions-cli in repository https://gitbox.apache.org/repos/asf/superset.git
commit 1f362115c486d447a831eb5dbe8dffeee747a4f7 Author: rusackas <[email protected]> AuthorDate: Wed Sep 9 14:53:41 2026 -0700 fix(security): use self-repository syntax in extensions-cli workflow zizmor's `self-repository` audit flags the workspace-relative `./...` refs to in-repo actions in the extensions-cli test workflow: GitHub has a dedicated `$/...` syntax for referencing an action that lives in the same repository being checked out. This matches the fix already applied to the same pair of actions (change-detector, setup-backend) in other workflows (e.g. superset-translations.yml, and open PRs for helm-lint-test.yml and testcontainers.yml). Resolves code-scanning alert #2639, and incidentally alert #2638 for the sibling change-detector ref on the adjacent line. Co-Authored-By: Evan Rusackas <[email protected]> Co-Authored-By: Claude Sonnet 5 <[email protected]> --- .github/workflows/superset-extensions-cli.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/superset-extensions-cli.yml b/.github/workflows/superset-extensions-cli.yml index ebee2bcc95c..1466b79d2fa 100644 --- a/.github/workflows/superset-extensions-cli.yml +++ b/.github/workflows/superset-extensions-cli.yml @@ -39,13 +39,13 @@ jobs: - name: Check for file changes id: check - uses: ./.github/actions/change-detector/ + uses: $/.github/actions/change-detector/ with: token: ${{ secrets.GITHUB_TOKEN }} - name: Setup Python if: steps.check.outputs.superset-extensions-cli - uses: ./.github/actions/setup-backend/ + uses: $/.github/actions/setup-backend/ with: python-version: ${{ matrix.python-version }} requirements-type: dev
