geido commented on code in PR #45655: URL: https://github.com/apache/superset/pull/45655#discussion_r4360039200
########## .github/workflows/supersetbot.yml: ########## @@ -1,6 +1,7 @@ name: SupersetBot Workflow on: + # zizmor: ignore[dangerous-triggers] - runs in default-branch context; checks out only the default branch (never PR code) with persist-credentials: false, and passes the comment body to the CLI via an env var rather than interpolating it into the script Review Comment: IIUC any commenter can trigger this, and `supersetbot label`/`unlabel` then add or remove any non-protected label with the job's write token, so I'm not sure it's quite a false positive. Would it make sense to call it an accepted risk in the rationale, or gate `label`/`unlabel` on `author_association`, since contributors do use `orglabel`? That way the rationale matches what the trigger allows. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
