You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/29 19:00:29 UTC

(superset) 01/01: chore(ci): pin @action-validator versions in GHA validator workflow

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch chore(ci)/pin-action-validator-versions
in repository https://gitbox.apache.org/repos/asf/superset.git

commit c09347bb2e8326f7b93f5ef102be8fc5810cd718
Author: Evan <ev...@preset.io>
AuthorDate: Mon Jun 29 12:00:17 2026 -0700

    chore(ci): pin @action-validator versions in GHA validator workflow
    
    Pin @action-validator/core and @action-validator/cli to 0.6.0 instead of
    installing them unpinned at runtime, resolving the zizmor adhoc-packages
    finding. Also drops the no-op --save-dev flag (meaningless for a global
    install).
    
    Resolves code-scanning alert #2557
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 .github/workflows/github-action-validator.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/github-action-validator.yml b/.github/workflows/github-action-validator.yml
index 2673354da55..73b1e6bb3d7 100644
--- a/.github/workflows/github-action-validator.yml
+++ b/.github/workflows/github-action-validator.yml
@@ -37,7 +37,9 @@ jobs:
           node-version: "20"
 
       - name: Install Dependencies
-        run: npm install -g @action-validator/core @action-validator/cli --save-dev
+        # Versions are pinned to avoid ad-hoc, unpinned package installs
+        # (zizmor adhoc-packages). Bump deliberately when upgrading.
+        run: npm install -g @action-validator/core@0.6.0 @action-validator/cli@0.6.0
 
       - name: Run Script
         run: bash .github/workflows/github-action-validator.sh