fix(ci): use current actions for Docker refresh

.github/workflows/bump-python-package.yml

@@ -40,7 +40,7 @@ jobs:
         uses: ./.github/actions/setup-supersetbot/
 
       - name: Set up Python ${{ inputs.python-version }}
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 

.github/workflows/scheduled-docker-image-refresh.yml

@@ -108,8 +108,18 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      # Keep workflow tooling on the triggering revision. Release tags can
+      # contain action pins that no longer satisfy the repository allowlist.
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          path: workflow-source
+          persist-credentials: false
+          sparse-checkout: .github/actions
+
       - name: Setup Docker Environment
-        uses: ./.github/actions/setup-docker
+        uses: ./workflow-source/.github/actions/setup-docker
         with:
           dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
           dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -122,7 +132,7 @@ jobs:
           node-version: 20
 
       - name: Setup supersetbot
-        uses: ./.github/actions/setup-supersetbot/
+        uses: ./workflow-source/.github/actions/setup-supersetbot/
 
       - name: Rebuild and push
         env:
@@ -171,7 +181,7 @@ jobs:
             --repo "$REPOSITORY" \
             --title "Scheduled Docker image refresh failed for ${LATEST_RELEASE}" \
             --label "infra:container" \
-            --label "bug" \
+            --label "#bug" \
             --body "The weekly Docker base-image refresh failed for release \`${LATEST_RELEASE}\`. Published images may be missing upstream base-layer security patches until this is resolved.
 
           Failed run: ${RUN_URL}"

scripts/change_detector.py

@@ -39,6 +39,7 @@ RETRYABLE_STATUS_CODES: frozenset[int] = frozenset({403, 429})
 PATTERNS = {
     "python": [
         r"^\.github/workflows/.*python",
+        r"^\.github/workflows/scheduled-docker-image-refresh\.yml$",
         r"^tests/",
         r"^superset/",
         r"^scripts/",

tests/unit_tests/scheduled_docker_image_refresh_test.py

@@ -0,0 +1,65 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from scripts import change_detector
+
+WORKFLOW_PATH = (
+    Path(__file__).resolve().parents[2]
+    / ".github/workflows/scheduled-docker-image-refresh.yml"
+)
+
+
+def load_workflow() -> dict[str, Any]:
+    return yaml.safe_load(WORKFLOW_PATH.read_text())
+
+
+def test_scheduled_refresh_uses_current_workflow_actions() -> None:
+    workflow = load_workflow()
+    steps = {step["name"]: step for step in workflow["jobs"]["docker-rebuild"]["steps"]}
+
+    action_checkout = steps["Checkout workflow actions"]
+    assert action_checkout["with"]["ref"] == "${{ github.sha }}"
+    assert action_checkout["with"]["path"] == "workflow-source"
+    assert (
+        steps["Setup Docker Environment"]["uses"]
+        == "./workflow-source/.github/actions/setup-docker"
+    )
+    assert (
+        steps["Setup supersetbot"]["uses"]
+        == "./workflow-source/.github/actions/setup-supersetbot/"
+    )
+
+
+def test_scheduled_refresh_notifier_uses_existing_labels() -> None:
+    workflow = load_workflow()
+    notify_step = workflow["jobs"]["notify-on-failure"]["steps"][0]
+
+    assert '--label "infra:container"' in notify_step["run"]
+    assert '--label "#bug"' in notify_step["run"]
+    assert '--label "bug"' not in notify_step["run"]
+
+
+def test_scheduled_refresh_changes_trigger_python_tests() -> None:
+    assert change_detector.detect_changes(
+        [".github/workflows/scheduled-docker-image-refresh.yml"],
+        change_detector.PATTERNS["python"],
+    )