QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-09 08:15:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(ci): pin @action-validator versions in GHA validator workflow

Browse Source 
Pin @action-validator/core and @action-validator/cli to 0.6.0 instead of
installing them unpinned at runtime, resolving the zizmor adhoc-packages
finding. Also drops the no-op --save-dev flag (meaningless for a global
install).

Resolves code-scanning alert #2557

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Evan
2026-06-29 12:00:17 -07:00
parent 134919ea36
commit c09347bb2e
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.github/workflows/github-action-validator.yml vendored
View File

@@ -37,7 +37,9 @@ jobs:
node-version: "20"
- name: Install Dependencies
run: npm install -g @action-validator/core @action-validator/cli --save-dev
# Versions are pinned to avoid ad-hoc, unpinned package installs
# (zizmor adhoc-packages). Bump deliberately when upgrading.
run: npm install -g @action-validator/core@0.6.0 @action-validator/cli@0.6.0
- name: Run Script
run: bash .github/workflows/github-action-validator.sh