(superset) branch fix/security-zizmor-self-repository-presto-celery created (now ea9b8ef600b)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/security-zizmor-self-repository-presto-celery
in repository https://gitbox.apache.org/repos/asf/superset.git


      at ea9b8ef600b fix(security): suppress zizmor self-repository false positive for celery worker step

This branch includes the following new commits:

     new ea9b8ef600b fix(security): suppress zizmor self-repository false positive for celery worker step

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(security): suppress zizmor self-repository false positive for celery worker step

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-zizmor-self-repository-presto-celery
in repository https://gitbox.apache.org/repos/asf/superset.git

commit ea9b8ef600bc84e51cd980344326805553c46ecd
Author: rusackas <ev...@rusackas.com>
AuthorDate: Tue Sep 8 01:44:57 2026 -0700

    fix(security): suppress zizmor self-repository false positive for celery worker step
    
    The `Start Celery worker` step in the `test-postgres-presto` job
    references `.github/actions/cached-dependencies` via the
    workspace-relative `uses: ./...` syntax. zizmor's `self-repository`
    audit flags this in favor of `uses: $/...`, but `cached-dependencies`
    is a git submodule and the `$/` syntax resolves action files directly
    from the repository tree without a submodule-aware checkout, so it
    can't see past the submodule's gitlink into the actual action.yml.
    
    This mirrors the same documented false-positive pattern already used
    for this action elsewhere in the repo (superset-translations.yml),
    suppressing it with a scoped `zizmor: ignore[self-repository]` comment.
    
    Resolves code-scanning alert #2665
---
 .github/workflows/superset-python-presto-hive.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-presto-hive.yml b/.github/workflows/superset-python-presto-hive.yml
index de39a69258b..9b18921f418 100644
--- a/.github/workflows/superset-python-presto-hive.yml
+++ b/.github/workflows/superset-python-presto-hive.yml
@@ -86,7 +86,13 @@ jobs:
         with:
           run: setup-postgres
       - name: Start Celery worker
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's link. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: celery-worker
       - name: Python unit tests (PostgreSQL)