ci: use git submodules for (securely) using third party Github Actions (#12709)

* Use git submodules for (securely) using third party Github Actions

List of repositories added as submodules:

EndBug/latest-tag@latest
morrisoncole/pr-lint-action@v1.4.1
trilom/file-changes-action@v1.2.4
styfle/cancel-workflow-action@0.6.0
apache-superset/cached-dependencies@b90713b
unsplash/comment-on-pr@v1.2.0

.github/workflows/cancel_duplicates.yml

@@ -9,6 +9,11 @@ jobs:
     name: "Cancel duplicate workflow runs"
     runs-on: ubuntu-latest
     steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - uses: ./.github/actions/cancel-workflow-runs/
         name: "Cancel duplicate workflow runs"
         with:

.github/workflows/docker-release.yml

@@ -8,9 +8,11 @@ jobs:
     name: build
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
         with:
+          persist-credentials: false
+          submodules: recursive
           ref: ${{ github.ref }}
       - shell: bash
         env:

.github/workflows/docker.yml

@@ -13,8 +13,10 @@ jobs:
     name: build
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - shell: bash
         env:

.github/workflows/latest-release-tag.yml

@@ -9,8 +9,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - name: Checkout repository
+    - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
       uses: actions/checkout@v2
+      with:
+        persist-credentials: false
+        submodules: recursive
 
     - name: Check for latest tag
       id: latest-tag

.github/workflows/misc.yml

@@ -11,7 +11,11 @@ jobs:
     name: License Check
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Java
         uses: actions/setup-java@v1
         with:
@@ -51,7 +55,11 @@ jobs:
     name: Prefer Typescript
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Get changed files
         id: changed
         uses: ./.github/actions/file-changes-action

.github/workflows/pr-lint.yml

@@ -12,7 +12,11 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - uses: ./.github/actions/pr-lint-action
         with:
           title-regex: "^(build|chore|ci|docs|feat|fix|perf|refactor|style|test|other)((.+))?:\\s.+"

.github/workflows/superset-docs.yml

@@ -13,8 +13,10 @@ jobs:
     name: build
     runs-on: ubuntu-20.04
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
       - name: npm install
         working-directory: ./docs
         run: |

.github/workflows/superset-e2e.yml

@@ -43,14 +43,19 @@ jobs:
         ports:
           - 16379:6379
     steps:
-      - name: Checkout code (push)
+      - name: "Checkout (pull) ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
         if: github.event_name == 'push'
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: "Checkout (pull_request) ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
-      - name: Checkout code (pull_request)
         if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
-        uses: actions/checkout@v2
         with:
           ref: "refs/pull/${{ github.event.number }}/merge"
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:

.github/workflows/superset-frontend.yml

@@ -13,8 +13,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-20.04
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Install dependencies
         uses: ./.github/actions/cached-dependencies
         with:

.github/workflows/superset-python-misc.yml

@@ -16,8 +16,11 @@ jobs:
       matrix:
         python-version: [3.7]
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:
@@ -40,8 +43,11 @@ jobs:
       matrix:
         python-version: [3.7]
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:
@@ -63,8 +69,11 @@ jobs:
       matrix:
         python-version: [3.7]
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:

.github/workflows/superset-python-presto-hive.yml

@@ -46,7 +46,11 @@ jobs:
         ports:
           - 16379:6379
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:
@@ -97,7 +101,11 @@ jobs:
         ports:
           - 16379:6379
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Create csv upload directory
         run: sudo mkdir -p /tmp/.superset/uploads
       - name: Give write access to the csv upload directory

.github/workflows/superset-python-unittest.yml

@@ -34,7 +34,11 @@ jobs:
         ports:
           - 16379:6379
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:
@@ -82,7 +86,11 @@ jobs:
         ports:
           - 16379:6379
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:
@@ -122,7 +130,11 @@ jobs:
         ports:
           - 16379:6379
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with:

.github/workflows/superset-translations.yml

@@ -12,8 +12,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-20.04
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Install dependencies
         uses: ./.github/actions/cached-dependencies
         with:
@@ -30,8 +33,11 @@ jobs:
       matrix:
         python-version: [3.7]
     steps:
-      - name: Checkout code
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+          submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v2
         with: