You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/07/02 17:35:03 UTC
(superset) 01/01: chore(ci): suppress zizmor adhoc-packages on GHA validator install
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch chore(ci)/suppress-adhoc-packages-validator-2558
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 62a17a8a9e291645e70ac2de8e373174cd93dd52
Author: Evan <ev...@preset.io>
AuthorDate: Thu Jul 2 10:34:31 2026 -0700
chore(ci): suppress zizmor adhoc-packages on GHA validator install
The github-action-validator workflow installs @action-validator globally
as a CLI tool to lint the repo's workflows. A global CLI install has no
application manifest/lockfile context, so zizmor's adhoc-packages check
is a false positive here. The versions are already pinned. Add a scoped
inline suppression matching the existing precedent in
.github/actions/setup-supersetbot/action.yml.
Resolves code-scanning alert #2558
Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
.github/workflows/github-action-validator.yml | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/github-action-validator.yml b/.github/workflows/github-action-validator.yml
index 73b1e6bb3d7..e2dfaef806a 100644
--- a/.github/workflows/github-action-validator.yml
+++ b/.github/workflows/github-action-validator.yml
@@ -37,8 +37,9 @@ jobs:
node-version: "20"
- name: Install Dependencies
- # Versions are pinned to avoid ad-hoc, unpinned package installs
- # (zizmor adhoc-packages). Bump deliberately when upgrading.
+ # Versions are pinned to avoid ad-hoc, unpinned package installs.
+ # Bump deliberately when upgrading.
+ # zizmor: ignore[adhoc-packages] - @action-validator is a global CLI tool installed to validate the repo's workflows; a global CLI install has no application manifest/lockfile context, and the versions are pinned above
run: npm install -g @action-validator/core@0.6.0 @action-validator/cli@0.6.0
- name: Run Script