fix(security): use self-repository syntax in frontend workflow

zizmor's self-repository audit flags the workspace-relative `./...` form for referencing the in-repo change-detector action. GitHub's `$/...` self-repository syntax is not subject to runtime filesystem state and is treated as a pinned reference for policy enforcement. Other workflows (e.g. superset-python-unittest.yml, superset-playwright.yml) already use this form for the same action. Resolves code-scanning alert #2640. Co-Authored-By: Evan Rusackas <evan@preset.io> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 01:04:25 +00:00 · 2026-09-09 14:48:52 -07:00
1 changed files with 1 additions and 1 deletions
@@ -41,7 +41,7 @@ jobs:

      - name: Check for File Changes
        id: check
-        uses: ./.github/actions/change-detector/
+        uses: $/.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}