chore(ci): silence zizmor adhoc-packages note for supersetbot install#41546
Merged
Conversation
rusackas
requested review from
betodealmeida,
craig-rueda,
dpgaspar,
eschutho,
geido,
hainenber,
kgabryje,
mistercrunch,
nytai,
sadpandajoe and
villebro
as code owners
June 29, 2026 19:02
Contributor
|
Bito Automatic Review Skipped - Files Excluded |
github-actions
Bot
added
the
github_actions
sadpandajoe
approved these changes
Jun 30, 2026
supersetbot is a first-party Apache CLI (apache-superset/supersetbot) installed globally as a tool; a global CLI install has no application manifest/lockfile context, so the lockfile-based remediation zizmor's adhoc-packages audit recommends does not apply. Add a scoped, justified ignore matching how other zizmor findings are suppressed in this repo. Resolves code-scanning alert #2555 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rusackas
force-pushed
the
chore/zizmor-adhoc-packages-supersetbot
branch
from
June 30, 2026 17:34
5d9f799 to
8f45ab9
Compare
rusackas
added
the
merge-if-green
Contributor
|
Bito Automatic Review Skipped – PR Already Merged |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Resolves code-scanning alert #2555 (zizmor
adhoc-packages, severity: note) at.github/actions/setup-supersetbot/action.yml:20.The
adhoc-packagesaudit flags anyrun:step that installs a package outside a managed/locked manifest (e.g.npm install <pkg>). Its recommended remediation is to add the package to apackage.json, commit a lockfile, and install vianpm ci.That remediation doesn't fit here:
supersetbotis a first-party Apache CLI published fromapache-superset/supersetbotand installed globally as a standalone tool for the workflow runner — there is no application manifest/lockfile context for a global CLI install, and the audit flags the install regardless of pinning anyway. This is therefore a benign case for the note.The fix adds a scoped, justified
# zizmor: ignore[adhoc-packages]comment, matching how other zizmor findings are already suppressed across this repo (e.g. thecache-poisoningignores intag-release.ymlfor the same supersetbot context).BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A
TESTING INSTRUCTIONS
pre-commit run --files .github/actions/setup-supersetbot/action.ymlpasses, including thezizmor (GHA security audit)hook. CI'sgithub-action-validator(zizmor-action) re-runs the audit on the PR.ADDITIONAL INFORMATION
🤖 Generated with Claude Code