fix(security): suppress zizmor self-repository false positive for postgres setup step

cached-dependencies is a git submodule, so the $/ self-repository syntax can't resolve it; keep the ./ form with a scoped zizmor suppression, matching the pattern used elsewhere in this workflow for the same action. Resolves code-scanning alert #2657. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-09 08:44:32 +00:00 · 2026-09-08 18:22:59 -07:00
1 changed files with 7 additions and 1 deletions
@@ -164,7 +164,13 @@ jobs:
        with:
          python-version: ${{ matrix.python-version }}
      - name: Setup Postgres
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a git submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's gitlink. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
        with:
          run: |
            setup-postgres