(superset) branch chore/ci-zizmor-adhoc-packages-supersetbot created (now 2eda10a780f)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch chore/ci-zizmor-adhoc-packages-supersetbot
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 2eda10a780f chore(ci): scope zizmor adhoc-packages on setup-supersetbot action

This branch includes the following new commits:

     new 2eda10a780f chore(ci): scope zizmor adhoc-packages on setup-supersetbot action

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: chore(ci): scope zizmor adhoc-packages on setup-supersetbot action

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch chore/ci-zizmor-adhoc-packages-supersetbot
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 2eda10a780f27850960459ff99973a4819517ba3
Author: Evan <ev...@preset.io>
AuthorDate: Mon Jun 29 12:02:56 2026 -0700

    chore(ci): scope zizmor adhoc-packages on setup-supersetbot action
    
    The setup-supersetbot composite action installs the supersetbot CLI
    globally (either from npm or from a locally packed tarball built from
    the trusted apache-superset/supersetbot checkout). Installing a global
    CLI tool has no lockfile-based install path, so zizmor's adhoc-packages
    audit is a justified false positive here. Add scoped, commented
    suppressions matching the existing convention in the workflows.
    
    Resolves code-scanning alert #2556
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 .github/actions/setup-supersetbot/action.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/actions/setup-supersetbot/action.yml b/.github/actions/setup-supersetbot/action.yml
index b6aca8c91ba..ce775510225 100644
--- a/.github/actions/setup-supersetbot/action.yml
+++ b/.github/actions/setup-supersetbot/action.yml
@@ -17,6 +17,7 @@ runs:
     - name: Install supersetbot from npm
       if: ${{ inputs.from-npm == 'true' }}
       shell: bash
+      # zizmor: ignore[adhoc-packages] - installing the supersetbot CLI globally is the sole purpose of this action; there is no lockfile-based install path for a global CLI tool
       run: npm install -g supersetbot
 
     - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
@@ -31,6 +32,7 @@ runs:
       if: ${{ inputs.from-npm == 'false' }}
       shell: bash
       working-directory: supersetbot
+      # zizmor: ignore[adhoc-packages] - installs the locally packed supersetbot tarball built from the trusted apache-superset/supersetbot checkout; no lockfile applies to a global CLI install
       run: |
         # simple trick to install globally with dependencies
         npm pack