(superset) 01/01: fix(security): use self-repository uses syntax in supersetbot workflow

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-supersetbot-self-repo-uses
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 39c42ac81448db82ab26416e60df50ca6a360341
Author: rusackas <ev...@rusackas.com>
AuthorDate: Mon Sep 7 05:51:05 2026 -0700

    fix(security): use self-repository uses syntax in supersetbot workflow
    
    Replaces the workspace-relative `./...` reference with GitHub's
    dedicated self-repository `$/...` syntax, which isn't subject to
    runtime filesystem state and lets GitHub enforce fully-pinned uses
    policies. Also bumps the pinned zizmor pre-commit dependency to
    1.30.0, the first release able to parse the new syntax (older
    versions hard-fail on `$/` refs) and the release that added this
    audit rule.
    
    Resolves code-scanning alert #2675
---
 .github/workflows/supersetbot.yml | 2 +-
 .pre-commit-config.yaml           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/supersetbot.yml b/.github/workflows/supersetbot.yml
index 09817762670..8f6cb587c7c 100644
--- a/.github/workflows/supersetbot.yml
+++ b/.github/workflows/supersetbot.yml
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup supersetbot
-        uses: ./.github/actions/setup-supersetbot/
+        uses: $/.github/actions/setup-supersetbot/
 
       - name: Execute custom Node.js script
         env:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c1503440ea8..5180b4a22e7 100755
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -178,7 +178,7 @@ repos:
         name: zizmor (GHA security audit)
         entry: zizmor
         language: python
-        additional_dependencies: [zizmor==1.25.2]
+        additional_dependencies: [zizmor==1.30.0]
         files: ^\.github/
         types: [yaml]
         pass_filenames: false