You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/05/12 02:54:09 UTC
[PR] chore(gha): pass commenter login through env in claude.yml [superset]
rusackas opened a new pull request, #40042:
URL: https://github.com/apache/superset/pull/40042
### SUMMARY
Small hardening of \`.github/workflows/claude.yml\`: move the \`github.event.*.user.login\` references off inline \`\${{ }}\` expansion inside the shell and \`actions/github-script\` bodies and onto step-level \`env:\` blocks, then read the values as \`\$COMMENTER\` / \`process.env.COMMENTER_LOGIN\`. This is the standard mitigation pattern recommended by [zizmor's template-injection rule](https://woodruffw.github.io/zizmor/audits/#template-injection) and matches the broader Superset workflow conventions.
No behavior change — the values resolved are identical, they just arrive via the runner-set environment instead of being interpolated into the script source before execution.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — workflow change only.
### TESTING INSTRUCTIONS
GitHub Actions workflow files aren't unit-testable in this repo's test suite. The change is verifiable by inspection:
- The shell step (\`Check if user is allowed\`) now declares \`env: COMMENTER: \${{ github.event.comment.user.login }}\` and reads \`\$COMMENTER\` from the environment.
- The \`actions/github-script\` step (\`Comment access denied\`) declares \`env: COMMENTER_LOGIN: ...\` and reads \`process.env.COMMENTER_LOGIN\`.
The allowed-users gating logic is unchanged.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(gha): pass commenter login through env in claude.yml [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40042:
URL: https://github.com/apache/superset/pull/40042#issuecomment-4426950806
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(gha): pass commenter login through env in claude.yml [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #40042:
URL: https://github.com/apache/superset/pull/40042#issuecomment-4426955837
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 5bc4a1e0a336778f6be5f330653f5596fe9fcbe0 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6a0296521488990008f8f367 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-40042--superset-docs-preview.netlify.app](https://deploy-preview-40042--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DcvJDYAgEEDRXuYsETcEO7AMZAlGZMioMcbYu9z-4f0XMuGeT5gAKlhIJxNKm4Dk6qDJusRM1Jd17EbafMSbrSlf51G4dTniM9syCM1bJYa26aVUinMuvfSdGOH7AQ) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-40042--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(gha): pass commenter login through env in claude.yml [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #40042:
URL: https://github.com/apache/superset/pull/40042
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org