(superset) branch fix/security-self-repository-integrationtest-celery-postgres created (now 1fc3759f13a)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/security-self-repository-integrationtest-celery-postgres
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 1fc3759f13a fix(security): suppress zizmor self-repository false positive for postgres celery worker step

This branch includes the following new commits:

     new 1fc3759f13a fix(security): suppress zizmor self-repository false positive for postgres celery worker step

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(security): suppress zizmor self-repository false positive for postgres celery worker step

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-self-repository-integrationtest-celery-postgres
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 1fc3759f13a3cee4510cad950f80fa2d348a603b
Author: rusackas <ev...@rusackas.com>
AuthorDate: Tue Sep 8 14:25:48 2026 -0700

    fix(security): suppress zizmor self-repository false positive for postgres celery worker step
    
    Resolves code-scanning alert #2658 (zizmor/self-repository) on
    .github/workflows/superset-python-integrationtest.yml:172.
    
    The `Start Celery worker` step in the `test-postgres` job references
    `.github/actions/cached-dependencies` via the workspace-relative `uses: ./...`
    form, which zizmor's self-repository audit flags in favor of `uses: $/...`.
    That rewrite can't be applied here: cached-dependencies is a real git
    submodule, and $/ resolves action files directly from the repository tree
    without a submodule-aware checkout, so it can't see past the submodule's
    gitlink into the actual action.yml. This mirrors the same constraint already
    documented and suppressed for the other cached-dependencies references in
    this file and in superset-translations.yml.
---
 .github/workflows/superset-python-integrationtest.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml
index 28e5c34567a..4a3c3986b06 100644
--- a/.github/workflows/superset-python-integrationtest.yml
+++ b/.github/workflows/superset-python-integrationtest.yml
@@ -169,7 +169,13 @@ jobs:
           run: |
             setup-postgres
       - name: Start Celery worker
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a git submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's gitlink. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: celery-worker
       - name: Python integration tests (PostgreSQL)