(superset) 01/01: fix(security): suppress zizmor self-repository false positive for postgres celery worker step

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-self-repository-integrationtest-celery-postgres
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 1fc3759f13a3cee4510cad950f80fa2d348a603b
Author: rusackas <ev...@rusackas.com>
AuthorDate: Tue Sep 8 14:25:48 2026 -0700

    fix(security): suppress zizmor self-repository false positive for postgres celery worker step
    
    Resolves code-scanning alert #2658 (zizmor/self-repository) on
    .github/workflows/superset-python-integrationtest.yml:172.
    
    The `Start Celery worker` step in the `test-postgres` job references
    `.github/actions/cached-dependencies` via the workspace-relative `uses: ./...`
    form, which zizmor's self-repository audit flags in favor of `uses: $/...`.
    That rewrite can't be applied here: cached-dependencies is a real git
    submodule, and $/ resolves action files directly from the repository tree
    without a submodule-aware checkout, so it can't see past the submodule's
    gitlink into the actual action.yml. This mirrors the same constraint already
    documented and suppressed for the other cached-dependencies references in
    this file and in superset-translations.yml.
---
 .github/workflows/superset-python-integrationtest.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml
index 28e5c34567a..4a3c3986b06 100644
--- a/.github/workflows/superset-python-integrationtest.yml
+++ b/.github/workflows/superset-python-integrationtest.yml
@@ -169,7 +169,13 @@ jobs:
           run: |
             setup-postgres
       - name: Start Celery worker
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a git submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's gitlink. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: celery-worker
       - name: Python integration tests (PostgreSQL)