(superset) branch fix/security-self-repository-playwright-testdata created (now cf5f1635209)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/security-self-repository-playwright-testdata
in repository https://gitbox.apache.org/repos/asf/superset.git


      at cf5f1635209 fix(security): suppress zizmor self-repository false positive for playwright test-data step

This branch includes the following new commits:

     new cf5f1635209 fix(security): suppress zizmor self-repository false positive for playwright test-data step

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(security): suppress zizmor self-repository false positive for playwright test-data step

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-self-repository-playwright-testdata
in repository https://gitbox.apache.org/repos/asf/superset.git

commit cf5f1635209df62c3afd59715ff6f48a90a55ce7
Author: rusackas <ev...@rusackas.com>
AuthorDate: Wed Sep 9 04:41:56 2026 -0700

    fix(security): suppress zizmor self-repository false positive for playwright test-data step
    
    cached-dependencies is a git submodule (not a plain directory), so the
    $/ self-repository syntax can't resolve it during the Import test data
    step of superset-playwright.yml. Keep the ./ form with a scoped zizmor
    suppression, consistent with the fix already applied to other
    occurrences of this action (#43972).
    
    Resolves code-scanning alert #2646.
    
    Co-Authored-By: Claude Sonnet 5 <no...@anthropic.com>
---
 .github/workflows/superset-playwright.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-playwright.yml b/.github/workflows/superset-playwright.yml
index 37675ca150d..01c2c9ae3a0 100644
--- a/.github/workflows/superset-playwright.yml
+++ b/.github/workflows/superset-playwright.yml
@@ -115,7 +115,13 @@ jobs:
         with:
           run: setup-postgres
       - name: Import test data
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's link. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: playwright_testdata
       - name: Setup Node.js