rusackas opened a new pull request, #44014:
URL: https://github.com/apache/superset/pull/44014
### SUMMARY
#43844 added a required **ASF Allowlist Check**
(`apache/infrastructure-actions`'s `allowlist-check`) that scans every `uses:`
ref under `.github/` and fails the build if the ref isn't on the ASF-approved
allowlist. Its skip logic only recognizes the legacy `./` local-action prefix:
```python
SKIPPED_PREFIXES = ("./", "docker://")
```
It has no notion of GitHub's newer `$/` self-repository syntax, so the three
local composite-action refs migrated to `$/` by #43969 (`change-detector`,
`setup-backend`, `setup-supersetbot`) get misclassified as external actions
needing ASF allowlist approval, and the check hard-fails on **every** PR that
touches `.github/**` — regardless of what the PR actually changes. See e.g.
#44002.
This reverts those three refs back to `./` so the check passes again. This
reintroduces zizmor's advisory (non-blocking, `--no-exit-codes`)
`self-repository` finding for the same three lines — an acceptable trade
against a hard-failing required check.
@hainenber has already opened the real fix upstream:
apache/infrastructure-actions#1254 (teach the allowlist check to recognize `$/`
refs). Once that merges, these three refs can be re-migrated to `$/` syntax.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — CI workflow YAML only.
### TESTING INSTRUCTIONS
- Fetched `check_asf_allowlist.py`, `approved_patterns.yml`, and
`actions.yml` from `apache/infrastructure-actions` and ran the check locally
against this branch's `.github/` tree:
```
Checking 37 unique action ref(s) against the ASF allowlist:
...
All 37 unique action refs are on the ASF allowlist
```
Before this change, the same run reported 5 refs across these 3 files as
not allowlisted (matching the CI failure on #44002).
- `pre-commit run --files .github/workflows/superset-translations.yml
.github/workflows/supersetbot.yml .github/workflows/tag-release.yml` passes
(zizmor advisory, non-blocking).
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
