This is an automated email from the ASF dual-hosted git repository. rusackas pushed a commit to branch fix/security-testcontainers-self-repository in repository https://gitbox.apache.org/repos/asf/superset.git
commit e1f64af730eb7659788ef938ebcc176844b07f08 Author: rusackas <[email protected]> AuthorDate: Wed Sep 9 14:40:46 2026 -0700 fix(security): use self-repository syntax for setup-backend in testcontainers workflow The `Setup Python` step in the testcontainers workflow references `.github/actions/setup-backend/` via the workspace-relative `uses: ./...` syntax, which zizmor's `self-repository` audit flags in favor of GitHub's dedicated `uses: $/...` syntax. Unlike the workspace-relative form, the self-repository form isn't subject to runtime filesystem state and is treated by GitHub as a pinned reference. `setup-backend` is a plain in-repo directory (not a git submodule), so the mechanical rewrite applies cleanly here, matching the already-merged fixes for the same pattern elsewhere in the workflow suite (#43975, #44018, #44040). The ASF allowlist check was bumped to allowlist-check/v1.0.1 in #44014 (merged), which recognizes the `$/` prefix, so this rewrite doesn't break that required check. Resolves code-scanning alert #2685 Co-Authored-By: Evan Rusackas <[email protected]> Co-Authored-By: Claude Sonnet 5 <[email protected]> --- .github/workflows/testcontainers.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/testcontainers.yml b/.github/workflows/testcontainers.yml index eede4e95666..51a54d0c685 100644 --- a/.github/workflows/testcontainers.yml +++ b/.github/workflows/testcontainers.yml @@ -119,7 +119,7 @@ jobs: with: persist-credentials: false - name: Setup Python - uses: ./.github/actions/setup-backend/ + uses: $/.github/actions/setup-backend/ with: python-version: current - name: Install db2 driver (ibm-db-sa)
