(superset) branch chore/ci-cache-ref-version-pin created (now 53e34b8d099)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch chore/ci-cache-ref-version-pin
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 53e34b8d099 chore(ci): correct actions/cache version comment to v5.0.5

This branch includes the following new commits:

     new 53e34b8d099 chore(ci): correct actions/cache version comment to v5.0.5

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: chore(ci): correct actions/cache version comment to v5.0.5

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch chore/ci-cache-ref-version-pin
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 53e34b8d099411a64e30e547facc3cb455e223ca
Author: Evan <ev...@preset.io>
AuthorDate: Sat Jun 27 01:42:37 2026 -0700

    chore(ci): correct actions/cache version comment to v5.0.5
    
    The actions/cache step pinned commit 27d5ce7 (= tag v5.0.5) but the
    trailing comment read "# v5". The v5 moving tag points to a different
    commit, so the comment was untruthful and zizmor flagged it as
    ref-version-mismatch. Update the comment to the exact version the SHA
    resolves to, matching the exact-version pin convention used elsewhere
    (e.g. actions/checkout # v6.0.3).
    
    Resolves code-scanning alert #2552
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 .github/workflows/pre-commit.yml | 2 +-
 .github/workflows/release.yml    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 12dacf84e95..416115793b7 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -63,7 +63,7 @@ jobs:
           yarn install --immutable
 
       - name: Cache pre-commit environments
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 593b77e60a2..c65074ae28e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,7 +56,7 @@ jobs:
 
       - name: Cache npm
         if: env.HAS_TAGS
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.npm # npm cache files are stored in `~/.npm` on Linux/macOS
           key: ${{ runner.OS }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -70,7 +70,7 @@ jobs:
         run: echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
       - name: Cache npm
         if: env.HAS_TAGS
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         id: npm-cache # use this to check for `cache-hit` (`steps.npm-cache.outputs.cache-hit != 'true'`)
         with:
           path: ${{ steps.npm-cache-dir-path.outputs.dir }}