From 45d0cad2e452dbb4c461dfe167c1ea6ea6d10b8f Mon Sep 17 00:00:00 2001 From: Evan Date: Wed, 24 Jun 2026 00:56:38 -0700 Subject: [PATCH] chore(ci): pin setup-python to truthful version comment The pinned commit a309ff8 for actions/setup-python resolves to release tag v6.2.0, but the inline comment claimed `# v6` (the floating major tag, which points at a different commit). zizmor's ref-version-mismatch rule flags this mismatch because the comment misrepresents the exact pinned version. Updated both occurrences to `# v6.2.0` so the comment matches the pinned SHA. Resolves code-scanning alert #2549 Co-Authored-By: Claude Opus 4.8 --- .github/actions/setup-backend/action.yml | 2 +- .github/workflows/bump-python-package.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/actions/setup-backend/action.yml b/.github/actions/setup-backend/action.yml index 63546093937..74f8842330a 100644 --- a/.github/actions/setup-backend/action.yml +++ b/.github/actions/setup-backend/action.yml @@ -42,7 +42,7 @@ runs: fi echo "python-version=$RESOLVED_VERSION" >> "$GITHUB_OUTPUT" - name: Set up Python ${{ steps.set-python-version.outputs.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ steps.set-python-version.outputs.python-version }} cache: ${{ inputs.cache }} diff --git a/.github/workflows/bump-python-package.yml b/.github/workflows/bump-python-package.yml index 48388492fdc..1dac5bb9923 100644 --- a/.github/workflows/bump-python-package.yml +++ b/.github/workflows/bump-python-package.yml @@ -40,7 +40,7 @@ jobs: uses: ./.github/actions/setup-supersetbot/ - name: Set up Python ${{ inputs.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.10"