(superset) 01/01: fix(security): suppress zizmor self-repository false positive for celery worker step

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-zizmor-self-repository-presto-celery
in repository https://gitbox.apache.org/repos/asf/superset.git

commit ea9b8ef600bc84e51cd980344326805553c46ecd
Author: rusackas <ev...@rusackas.com>
AuthorDate: Tue Sep 8 01:44:57 2026 -0700

    fix(security): suppress zizmor self-repository false positive for celery worker step
    
    The `Start Celery worker` step in the `test-postgres-presto` job
    references `.github/actions/cached-dependencies` via the
    workspace-relative `uses: ./...` syntax. zizmor's `self-repository`
    audit flags this in favor of `uses: $/...`, but `cached-dependencies`
    is a git submodule and the `$/` syntax resolves action files directly
    from the repository tree without a submodule-aware checkout, so it
    can't see past the submodule's gitlink into the actual action.yml.
    
    This mirrors the same documented false-positive pattern already used
    for this action elsewhere in the repo (superset-translations.yml),
    suppressing it with a scoped `zizmor: ignore[self-repository]` comment.
    
    Resolves code-scanning alert #2665
---
 .github/workflows/superset-python-presto-hive.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-presto-hive.yml b/.github/workflows/superset-python-presto-hive.yml
index de39a69258b..9b18921f418 100644
--- a/.github/workflows/superset-python-presto-hive.yml
+++ b/.github/workflows/superset-python-presto-hive.yml
@@ -86,7 +86,13 @@ jobs:
         with:
           run: setup-postgres
       - name: Start Celery worker
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's link. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: celery-worker
       - name: Python unit tests (PostgreSQL)