(superset) branch fix-showtime-permissions created (now 55bf380ed6a)

[jl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sadpandajoe pushed a change to branch fix-showtime-permissions
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 55bf380ed6a fix(ci): opt showtime checkout into fork-PR code fetch under checkout v7

This branch includes the following new commits:

     new 55bf380ed6a fix(ci): opt showtime checkout into fork-PR code fetch under checkout v7

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(ci): opt showtime checkout into fork-PR code fetch under checkout v7

[jl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sadpandajoe pushed a commit to branch fix-showtime-permissions
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 55bf380ed6a7b1404a3dc22f50ecf919895e5ce0
Author: Joe Li <jo...@preset.io>
AuthorDate: Wed Jul 1 14:18:23 2026 -0700

    fix(ci): opt showtime checkout into fork-PR code fetch under checkout v7
    
    actions/checkout v7.0.0 (#41358) refuses to check out fork PR code from a
    pull_request_target workflow unless the step sets
    allow-unsafe-pr-checkout: true, which broke every showtime launch on fork
    PRs. The checkout is already gated behind the maintainer-authorization
    step (write/admin actors only) and uses persist-credentials: false, so
    opt in explicitly and fix the stale zizmor comment that claimed the
    workflow never checks out PR code.
    
    Co-Authored-By: Claude Fable 5 <no...@anthropic.com>
---
 .github/workflows/showtime-trigger.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/showtime-trigger.yml b/.github/workflows/showtime-trigger.yml
index e880476cf09..f8220e8de8b 100644
--- a/.github/workflows/showtime-trigger.yml
+++ b/.github/workflows/showtime-trigger.yml
@@ -2,7 +2,8 @@ name: 🎪 Superset Showtime
 
 # Ultra-simple: just sync on any PR state change
 on:
-  # zizmor: ignore[dangerous-triggers] - required to react to PR label changes; this workflow does not check out or execute PR-provided code
+  # zizmor: ignore[dangerous-triggers] - required to react to PR label changes; PR code is
+  # only checked out and built after the maintainer-authorization gate (write/admin actors)
   pull_request_target:
     types: [labeled, unlabeled, synchronize, closed]
 
@@ -156,6 +157,10 @@ jobs:
         with:
           ref: ${{ steps.check.outputs.target_sha }}
           persist-credentials: false
+          # Building fork PR code is Showtime's purpose: deploys are gated on the
+          # maintainer-authorization step above (write/admin actors only), so this
+          # checkout is an explicit, authorized opt-in rather than an automatic one.
+          allow-unsafe-pr-checkout: true
 
       - name: Setup Docker Environment (only if build needed)
         if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'