rusackas commented on code in PR #45655: URL: https://github.com/apache/superset/pull/45655#discussion_r4380504371
########## .github/workflows/supersetbot.yml: ########## @@ -1,6 +1,7 @@ name: SupersetBot Workflow on: + # zizmor: ignore[dangerous-triggers] - runs in default-branch context; checks out only the default branch (never PR code) with persist-credentials: false, and passes the comment body to the CLI via an env var rather than interpolating it into the script Review Comment: Fair, I was only thinking about the code-exec side. Reworded the rationale to call the label/unlabel access out as an accepted risk, so it matches what the trigger allows. Gating on author_association seems reasonable too, but I would rather do that as a separate change since contributors rely on orglabel. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
