Merge branch 'master' into fix/security-self-repository-integrationtest-celery-postgres

fix(security): suppress zizmor self-repository false positive for postgres celery worker step
Resolves code-scanning alert #2658 (zizmor/self-repository) on .github/workflows/superset-python-integrationtest.yml:172. The `Start Celery worker` step in the `test-postgres` job references `.github/actions/cached-dependencies` via the workspace-relative `uses: ./...` form, which zizmor's self-repository audit flags in favor of `uses: $/...`. That rewrite can't be applied here: cached-dependencies is a real git submodule, and $/ resolves action files directly from the repository tree without a submodule-aware checkout, so it can't see past the submodule's gitlink into the actual action.yml. This mirrors the same constraint already documented and suppressed for the other cached-dependencies references in this file and in superset-translations.yml.
2026-09-09 16:54:29 +00:00 · 2026-09-08 16:35:50 -07:00 · 2026-09-08 14:25:48 -07:00
1 changed files with 7 additions and 1 deletions
@@ -169,7 +169,13 @@ jobs:
          run: |
            setup-postgres
      - name: Start Celery worker
-        uses: ./.github/actions/cached-dependencies
+        # cached-dependencies is a git submodule (not a plain directory), and
+        # the $/ self-repository syntax resolves action files directly from
+        # the repository without performing a real (submodule-aware)
+        # checkout, so it can't see into a submodule's gitlink. Keep this one
+        # on the workspace-relative ./ form, consistent with every other
+        # workflow in the repo that references this action.
+        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
        with:
          run: celery-worker
      - name: Python integration tests (PostgreSQL)