You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/07/14 12:08:23 UTC
(superset) 01/01: fix(ci): correct setup-node version comment in tech-debt.yml
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch fix-security/tech-debt-workflow-setup-node-version-comment
in repository https://gitbox.apache.org/repos/asf/superset.git
commit dd4e62d1ff7ae210b511ab8745b096633a56dd1e
Author: Evan <ev...@preset.io>
AuthorDate: Tue Jul 14 05:07:58 2026 -0700
fix(ci): correct setup-node version comment in tech-debt.yml
The action pin points to actions/setup-node v6.4.0 but was commented
as `# v6`, which zizmor flags as a version-comment mismatch since the
mutable v6 tag currently resolves to a different commit. Align the
comment with the actual pinned version, matching the convention
already used in github-action-validator.yml and superset-websocket.yml.
Resolves code-scanning alert #2582.
---
.github/workflows/tech-debt.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/tech-debt.yml b/.github/workflows/tech-debt.yml
index 1224ceb33fe..0a545df0376 100644
--- a/.github/workflows/tech-debt.yml
+++ b/.github/workflows/tech-debt.yml
@@ -37,7 +37,7 @@ jobs:
persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+ uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version-file: "./superset-frontend/.nvmrc"