mirror of
https://github.com/apache/airflow.git
synced 2026-11-04 07:12:48 +00:00
github-actions[bot]andJarek Potiuk
f044973164
* [main] CI: Upgrade important CI environment * Keep workspace-relative action references in CI workflows zizmor 1.30.0 adds the self-repository audit, which wants every in-repo `uses: ./...` rewritten to GitHub's `uses: $/...` form. Converting the workflows proved that two things outside this repository's control stop the new syntax from working here. `$/` makes the runner fetch apache/airflow as an action repository, and that download cannot materialise the symlinks this repository commits: it aborts on `.claude/skills/airflow-translations`, whose target is not tracked, before any job starts. Separately, ASF infrastructure's allowlist check does not recognise the syntax and reports every `$/...` reference as an action missing from the allowlist. Nor does the audit's threat model reach us in the meantime -- it guards a privileged workflow against loading a local action out of a checkout untrusted code could have altered first, and no Airflow workflow runs on `pull_request_target` or `workflow_run`. Generated-by: Claude Code (Opus 5) Claude-Session: https://claude.ai/code/session_01EbprJE5EYQ2Ng7DwAyQdgB --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Jarek Potiuk <jarek@potiuk.com>