You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/07/14 12:10:52 UTC
(superset) branch fix-security/setup-node-ref-version-mismatch-2580 created (now f54a091c261)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch fix-security/setup-node-ref-version-mismatch-2580
in repository https://gitbox.apache.org/repos/asf/superset.git
at f54a091c261 fix(ci): correct setup-node version comment in tag-release.yml
This branch includes the following new commits:
new f54a091c261 fix(ci): correct setup-node version comment in tag-release.yml
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: fix(ci): correct setup-node version comment in tag-release.yml
Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch fix-security/setup-node-ref-version-mismatch-2580
in repository https://gitbox.apache.org/repos/asf/superset.git
commit f54a091c261f4dd48bc469604581ac8bb73ffed1
Author: Evan <ev...@preset.io>
AuthorDate: Tue Jul 14 05:10:14 2026 -0700
fix(ci): correct setup-node version comment in tag-release.yml
The actions/setup-node pin was commented as "v6", but the mutable v6
tag has since moved to a newer commit, leaving the comment untruthful
about which release the pinned SHA actually corresponds to. Point the
comment at the exact release tag (v6.4.0) that matches the pinned SHA,
matching the convention already used elsewhere in the repo (e.g.
.github/actions/setup-supersetbot/action.yml).
Resolves code-scanning alert #2580 (zizmor/ref-version-mismatch), and
fixes the duplicate instance of the same issue at line 136 of the same
file (alert #2581).
---
.github/workflows/tag-release.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 7488c555568..fdf67aa0881 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -75,7 +75,7 @@ jobs:
- name: Use Node.js 20
# zizmor: ignore[cache-poisoning] - node only runs the supersetbot CLI; no dependency cache is enabled
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+ uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
package-manager-cache: false
@@ -133,7 +133,7 @@ jobs:
- name: Use Node.js 20
# zizmor: ignore[cache-poisoning] - node only runs the supersetbot CLI; no dependency cache is enabled
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+ uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 20
package-manager-cache: false