(superset) branch fix/security-self-repository-cached-dependencies created (now e92094a1004)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/security-self-repository-cached-dependencies
in repository https://gitbox.apache.org/repos/asf/superset.git


      at e92094a1004 fix(security): suppress zizmor self-repository false positive for cached-dependencies

This branch includes the following new commits:

     new e92094a1004 fix(security): suppress zizmor self-repository false positive for cached-dependencies

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(security): suppress zizmor self-repository false positive for cached-dependencies

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/security-self-repository-cached-dependencies
in repository https://gitbox.apache.org/repos/asf/superset.git

commit e92094a100491279f749de26ec110e5f1a1bb417
Author: rusackas <ev...@rusackas.com>
AuthorDate: Mon Sep 7 12:40:47 2026 -0700

    fix(security): suppress zizmor self-repository false positive for cached-dependencies
    
    The `cached-dependencies` action is a git submodule, not a plain
    directory. GitHub's `$/...` self-repository syntax resolves action
    files directly from the repository tree without a submodule-aware
    checkout, so it can't see into the submodule's gitlink and this step
    must stay on the workspace-relative `./...` form. Add the zizmor
    inline-ignore comment (trailing on the `uses:` line, per zizmor's
    comment-placement rules) so the tool's own scan reflects the
    already-documented, deliberate exception.
    
    Resolves code-scanning alert #2672
    
    Co-Authored-By: Claude Sonnet 5 <no...@anthropic.com>
---
 .github/workflows/superset-translations.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/superset-translations.yml b/.github/workflows/superset-translations.yml
index a8a0d61b7cc..605953453c2 100644
--- a/.github/workflows/superset-translations.yml
+++ b/.github/workflows/superset-translations.yml
@@ -51,7 +51,7 @@ jobs:
         # checkout, so it can't see into a submodule's gitlink. Keep this one
         # on the workspace-relative ./ form, consistent with every other
         # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
         with:
           run: npm-install
       - name: lint