(superset) 01/01: fix(security): suppress zizmor self-repository false positive for sqlite install-deps step

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-zizmor-self-repository-integrationtest-2660
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 612c70bee30a71959256f6e8086f638893f84a07
Author: rusackas <ev...@rusackas.com>
AuthorDate: Tue Sep 8 08:10:08 2026 -0700

    fix(security): suppress zizmor self-repository false positive for sqlite install-deps step
    
    The `Install dependencies` step in the `test-sqlite` job references
    `.github/actions/cached-dependencies` via the workspace-relative
    `uses: ./...` syntax, which zizmor's self-repository audit flags in favor
    of the newer `uses: $/...` syntax. The mechanical fix doesn't apply here:
    cached-dependencies is a git submodule, and $/... resolves action files
    directly from the repository tree without a submodule-aware checkout, so
    it can't see past the submodule's gitlink into the actual action.yml.
    
    This mirrors the same documented false-positive pattern already used for
    this action elsewhere in the repo.
    
    Resolves code-scanning alert #2660
    
    Co-Authored-By: Claude Sonnet 5 <no...@anthropic.com>
---
 .github/workflows/superset-python-integrationtest.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml
index 28e5c34567a..1c5cc871ae3 100644
--- a/.github/workflows/superset-python-integrationtest.yml
+++ b/.github/workflows/superset-python-integrationtest.yml
@@ -212,7 +212,13 @@ jobs:
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
       - name: Install dependencies
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a git submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's gitlink. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: |
             # sqlite needs this working directory