(superset) branch fix/security/zizmor-self-repository-python-unittest created (now 27ebbd9386d)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/security/zizmor-self-repository-python-unittest
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 27ebbd9386d fix(security): use self-repository syntax for change-detector action ref

This branch includes the following new commits:

     new 27ebbd9386d fix(security): use self-repository syntax for change-detector action ref

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(security): use self-repository syntax for change-detector action ref

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security/zizmor-self-repository-python-unittest
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 27ebbd9386d42a7b4d4fb106e11577e7f368d339
Author: rusackas <ev...@rusackas.com>
AuthorDate: Mon Sep 7 12:35:19 2026 -0700

    fix(security): use self-repository syntax for change-detector action ref
    
    The workspace-relative `./` form resolves against runtime filesystem
    state, so zizmor flags it as unpinned. GitHub's `$/` self-repository
    syntax always resolves to the exact commit the workflow is running at,
    matching the pattern already used elsewhere in this repo (e.g. #43962,
    #43965).
    
    Resolves code-scanning alert #2669.
---
 .github/workflows/superset-python-unittest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-unittest.yml b/.github/workflows/superset-python-unittest.yml
index 75cf669af56..1948d009279 100644
--- a/.github/workflows/superset-python-unittest.yml
+++ b/.github/workflows/superset-python-unittest.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
       - name: Check for file changes
         id: check
-        uses: ./.github/actions/change-detector/
+        uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}