3 people 9fc07f384e fix(security): use self-repository syntax in frontend workflow ...

zizmor's self-repository audit flags the workspace-relative `./...`
form for referencing the in-repo change-detector action. GitHub's
`$/...` self-repository syntax is not subject to runtime filesystem
state and is treated as a pinned reference for policy enforcement.
Other workflows (e.g. superset-python-unittest.yml,
superset-playwright.yml) already use this form for the same action.

Resolves code-scanning alert #2640.

Co-Authored-By: Evan Rusackas <evan@preset.io>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-09 14:48:52 -07:00

..

scripts

fix(ci): stop superseded Docs Deployment runs from showing as cancelled (#42488)

2026-08-14 12:14:08 -07:00

asf-allowlist-check.yml

ci: bump ASF allowlist-check to v1.0.1 for self-repository syntax support (#44014)

2026-09-08 15:49:12 -07:00

bashlib.sh

ci(e2e): stop gunicorn worker recycling mid-run; slow-test budget for mixed-chart filter spec (#42867)

2026-08-11 12:43:51 -07:00

bump-python-package.yml

chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#43378)

2026-08-21 01:10:37 -07:00

caches.js

…

check-db-migration-confict.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

check-openapi-spec-drift.yml

ci: show the spec diff when the staleness check fails (#43912)

2026-09-04 17:54:04 -07:00

check-python-deps.yml

chore(deps): bump Kesin11/actions-timeline from 3.1.1 to 3.2.0 (#42969)

2026-08-10 01:28:10 -07:00

codeql-analysis.yml

chore(deps): bump github/codeql-action/analyze from 4.37.8 to 4.37.9 (#43791)

2026-09-02 12:52:39 -07:00

dependabot-auto-approve.yml

feat(ci): auto-approve Dependabot patch-level bumps (#42508)

2026-07-31 09:15:26 -07:00

dependency-review.yml

chore(deps): bump setuptools to 84.0.0 and pip to 26.2.1 (#43413)

2026-08-28 18:34:09 -07:00

docker.yml

feat: migrate Global Async Queries onto the Global Task Framework (#43407)

2026-09-04 19:21:37 -07:00

ecs-task-definition.json

…

embedded-sdk-release.yml

feat(ci): switch to ubuntu-slim runner image for faster startup time when running light CI workloads (#39656)

2026-08-03 23:31:06 +07:00

embedded-sdk-test.yml

feat(ci): switch to ubuntu-slim runner image for faster startup time when running light CI workloads (#39656)

2026-08-03 23:31:06 +07:00

enforce-single-migration-head.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

frontend-bundle-size-nightly.yml

fix(ci): restore scheduled CI checks (#43266)

2026-08-24 12:31:50 -07:00

generate-FOSSA-report.yml

chore(deps): bump actions/setup-java from 5.7.0 to 6.0.0 (#43707)

2026-08-31 15:04:47 +07:00

github-action-validator.sh

…

github-action-validator.yml

chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#43954)

2026-09-07 02:38:16 -07:00

hold-label-ci-gate.yml

feat(ci): broaden usage of fast-startup ubuntu-slim runner (#43477)

2026-09-04 22:25:10 +07:00

issue-creation.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

label-merge-conflicts.yml

feat(ci): auto-label PRs with merge conflicts using requires:rebase (#42504)

2026-08-01 10:38:02 -07:00

labeler.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

license-check.yml

chore(deps): bump actions/setup-java from 5.7.0 to 6.0.0 (#43707)

2026-08-31 15:04:47 +07:00

mirror-service-images.yml

chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#43445)

2026-08-24 22:16:57 +07:00

no-hold-label.yml

feat(ci): switch to ubuntu-slim runner image for faster startup time when running light CI workloads (#39656)

2026-08-03 23:31:06 +07:00

pr-lint.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

pre-commit.yml

feat(ci): broaden usage of fast-startup ubuntu-slim runner (#43477)

2026-09-04 22:25:10 +07:00

release.yml

feat(ci): switch to ubuntu-slim runner image for faster startup time when running light CI workloads (#39656)

2026-08-03 23:31:06 +07:00

scheduled-docker-image-refresh.yml

fix(ci): use current actions for Docker refresh (#42482)

2026-08-11 12:04:09 -07:00

showtime-cleanup.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

showtime-trigger.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

superset-app-cli.yml

chore(deps): bump Kesin11/actions-timeline from 3.1.1 to 3.2.0 (#42969)

2026-08-10 01:28:10 -07:00

superset-docs-deploy.yml

chore(deps): bump actions/setup-java from 5.7.0 to 6.0.0 (#43707)

2026-08-31 15:04:47 +07:00

superset-docs-verify.yml

chore(deps): bump dawidd6/action-download-artifact from 21 to 24 (#43441)

2026-08-27 10:24:38 -07:00

superset-e2e.yml

ci(playwright): make embedded and app-root E2E coverage required (#43919)

2026-09-06 10:17:59 +07:00

superset-extensions-cli.yml

feat(ci): broaden usage of fast-startup ubuntu-slim runner (#43477)

2026-09-04 22:25:10 +07:00

superset-frontend.yml

fix(security): use self-repository syntax in frontend workflow

2026-09-09 14:48:52 -07:00

superset-helm-lint-test.yml

chore: deprecate helm chart (#44097)

2026-09-09 14:39:56 -07:00

superset-helm-release.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00

superset-playwright.yml

fix(security): suppress zizmor self-repository false positive for playwright experimental step (#44064)

2026-09-09 22:33:33 +07:00

superset-python-integrationtest.yml

fix(security): use self-repository syntax for change-detector in integration tests (#44065)

2026-09-09 22:33:42 +07:00

superset-python-presto-hive.yml

fix(security): suppress zizmor self-repository false positive for cached-dependencies in presto-hive workflow (#43976)

2026-09-08 16:53:30 -07:00

superset-python-unittest-report.yml

feat(ci): publish Python unit test results as PR check annotations (#42503)

2026-08-13 10:26:42 -07:00

superset-python-unittest.yml

fix(security): use self-repository syntax for setup-backend ref in unit-test workflow (#43970)

2026-09-08 16:31:39 -07:00

superset-translations-comment.yml

feat(ci): broaden usage of fast-startup ubuntu-slim runner (#43477)

2026-09-04 22:25:10 +07:00

superset-translations.yml

fix(security): suppress zizmor self-repository false positive for cached-dependencies (#43972)

2026-09-08 16:52:42 -07:00

superset-websocket.yml

feat(build/websocket): upgrade to Typescript 7 + migrate ESLint to TS7-compatible oxlint andtsgolint (#43703)

2026-09-04 21:31:10 +07:00

supersetbot.yml

fix(security): use self-repository uses syntax in supersetbot workflow (#43962)

2026-09-07 12:27:17 -07:00

sync-requirements-for-python-dep-upgrade-pr.yml

chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#42769)

2026-08-05 22:24:57 +07:00

tag-release.yml

fix(ci): use self-repository syntax for local supersetbot action ref (#43963)

2026-09-08 16:30:33 -07:00

tech-debt.yml

feat(ci): switch to ubuntu-slim runner image for faster startup time when running light CI workloads (#39656)

2026-08-03 23:31:06 +07:00

testcontainers.yml

feat(ci): add testcontainers-based db_engine_specs tests (7 dialects) (#43502)

2026-09-09 11:41:09 -07:00

welcome-new-users.yml

ci: declare top-level permissions on the remaining workflows (#43197)

2026-08-15 14:48:43 +07:00