(superset) branch master updated: chore(ci): scope zizmor adhoc-packages on setup-supersetbot action (#41547)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/master by this push:
     new 7245a092eb5 chore(ci): scope zizmor adhoc-packages on setup-supersetbot action (#41547)
7245a092eb5 is described below

commit 7245a092eb55c0ff0a437ac2a50d5a07c74e8219
Author: Evan Rusackas <ev...@preset.io>
AuthorDate: Tue Jun 30 10:31:21 2026 -0700

    chore(ci): scope zizmor adhoc-packages on setup-supersetbot action (#41547)
    
    Co-authored-by: Claude Opus 4.8 <no...@anthropic.com>
---
 .github/actions/setup-supersetbot/action.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/actions/setup-supersetbot/action.yml b/.github/actions/setup-supersetbot/action.yml
index b6aca8c91ba..ce775510225 100644
--- a/.github/actions/setup-supersetbot/action.yml
+++ b/.github/actions/setup-supersetbot/action.yml
@@ -17,6 +17,7 @@ runs:
     - name: Install supersetbot from npm
       if: ${{ inputs.from-npm == 'true' }}
       shell: bash
+      # zizmor: ignore[adhoc-packages] - installing the supersetbot CLI globally is the sole purpose of this action; there is no lockfile-based install path for a global CLI tool
       run: npm install -g supersetbot
 
     - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
@@ -31,6 +32,7 @@ runs:
       if: ${{ inputs.from-npm == 'false' }}
       shell: bash
       working-directory: supersetbot
+      # zizmor: ignore[adhoc-packages] - installs the locally packed supersetbot tarball built from the trusted apache-superset/supersetbot checkout; no lockfile applies to a global CLI install
       run: |
         # simple trick to install globally with dependencies
         npm pack