fix(reports): send only chart or dashboard when creating a report, not both

Creating a report or alert from a chart opened in Explore from within a dashboard failed with HTTP 422 `{"message": {"chart": "Choose a chart or dashboard not both"}}`. The report modal built its payload with both `chart` and `dashboard` set unconditionally, so Explore's dashboard context (used for the report fetch/edit lookup) leaked into a chart-scoped report payload and the backend rejected it. Opening the same chart from the Charts list, where there is no dashboard context, worked. A report belongs to either a chart or a dashboard, never both. Select the owning entity by creation method: chart-scoped reports send only `chart`, dashboard-scoped reports send only `dashboard`. This flows through both the create (subscribe) and edit paths, which share the payload builder. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix(security): suppress zizmor self-repository false positive for sqlite install-deps step (#44002 )
2026-09-09 08:44:32 +00:00 · 2026-09-09 03:52:53 +00:00 · 2026-09-08 18:25:00 -07:00
2 changed files with 11 additions and 1 deletions
@@ -212,7 +212,13 @@ jobs:
      - name: Setup Python
        uses: $/.github/actions/setup-backend/
      - name: Install dependencies
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a git submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's gitlink. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
        with:
          run: |
            # sqlite needs this working directory
@@ -195,6 +195,10 @@ function ReportModal({
      active: true,
      force_screenshot: false,
      custom_width: currentReport.custom_width,
+      // A report belongs to either a chart or a dashboard, never both. Explore can
+      // carry dashboard context even for a chart-scoped report, so send only the
+      // entity that matches the creation method; a payload with both `chart` and
+      // `dashboard` is rejected by the backend with a 422 error.
      ...(creationMethod === CreationMethod.Charts
        ? { chart: chart?.id }
        : { dashboard: dashboardId }),