(superset) 01/01: fix(security): suppress zizmor self-repository false positive for cached-dependencies Setup Postgres step

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-zizmor-self-repository-2664
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 068e182d0a3e782a6bb31c2daa488dc61af9f1bb
Author: rusackas <ev...@rusackas.com>
AuthorDate: Tue Sep 8 01:38:39 2026 -0700

    fix(security): suppress zizmor self-repository false positive for cached-dependencies Setup Postgres step
    
    cached-dependencies is a git submodule, and the $/ self-repository
    syntax resolves action files directly from the repository tree
    without a submodule-aware checkout, so it can't see past the
    submodule's gitlink into the actual action.yml. This mirrors the
    same documented pattern already used for this action elsewhere in
    the repo (superset-translations.yml, and the Start Celery worker
    step in this same workflow).
    
    Resolves code-scanning alert #2664
---
 .github/workflows/superset-python-presto-hive.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-presto-hive.yml b/.github/workflows/superset-python-presto-hive.yml
index de39a69258b..37866353dee 100644
--- a/.github/workflows/superset-python-presto-hive.yml
+++ b/.github/workflows/superset-python-presto-hive.yml
@@ -82,7 +82,13 @@ jobs:
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
       - name: Setup Postgres
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's link. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: setup-postgres
       - name: Start Celery worker