fix(security): use self-repository syntax for setup-backend in postgres job

zizmor's self-repository audit flags uses: ./.github/actions/setup-backend/ in the test-postgres job in favor of GitHub's dedicated uses: $/... syntax. This mirrors the mechanical fix already applied to the analogous setup-backend references in this same workflow (test-sqlite, #44018) and in superset-python-presto-hive.yml (#43975), now that the ASF allowlist check has been bumped to recognize $/ refs (#44014). Resolves code-scanning alert #2656. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-09 08:44:32 +00:00 · 2026-09-08 18:25:50 -07:00
1 changed files with 1 additions and 1 deletions
@@ -160,7 +160,7 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Python
-        uses: ./.github/actions/setup-backend/
+        uses: $/.github/actions/setup-backend/
        with:
          python-version: ${{ matrix.python-version }}
      - name: Setup Postgres