(superset) 01/01: fix(security): use self-repository syntax for change-detector action ref

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security/zizmor-self-repository-python-unittest
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 27ebbd9386d42a7b4d4fb106e11577e7f368d339
Author: rusackas <ev...@rusackas.com>
AuthorDate: Mon Sep 7 12:35:19 2026 -0700

    fix(security): use self-repository syntax for change-detector action ref
    
    The workspace-relative `./` form resolves against runtime filesystem
    state, so zizmor flags it as unpinned. GitHub's `$/` self-repository
    syntax always resolves to the exact commit the workflow is running at,
    matching the pattern already used elsewhere in this repo (e.g. #43962,
    #43965).
    
    Resolves code-scanning alert #2669.
---
 .github/workflows/superset-python-unittest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-unittest.yml b/.github/workflows/superset-python-unittest.yml
index 75cf669af56..1948d009279 100644
--- a/.github/workflows/superset-python-unittest.yml
+++ b/.github/workflows/superset-python-unittest.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
       - name: Check for file changes
         id: check
-        uses: ./.github/actions/change-detector/
+        uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}