Skip to content

Commit 64ee6c5

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into lessnoise
2 parents e9971ff + 8f0b985 commit 64ee6c5

File tree

482 files changed

+18546
-3869
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

482 files changed

+18546
-3869
lines changed

‎CODEOWNERS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
/java/ql/test-kotlin1/ @github/codeql-kotlin
1515
/java/ql/test-kotlin2/ @github/codeql-kotlin
1616

17+
# Experimental CodeQL cryptography
18+
**/experimental/quantum/ @github/ps-codeql
19+
1720
# CodeQL tools and associated docs
1821
/docs/codeql/codeql-cli/ @github/codeql-cli-reviewers
1922
/docs/codeql/codeql-for-visual-studio-code/ @github/codeql-vscode-reviewers

‎actions/ql/lib/CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## 0.4.6
2+
3+
### Bug Fixes
4+
5+
* The query `actions/code-injection/medium` now produces alerts for injection
6+
vulnerabilities on `pull_request` events.
7+
18
## 0.4.5
29

310
No user-facing changes.

‎actions/ql/lib/change-notes/2025-03-20-code-injection-pr.md renamed to ‎actions/ql/lib/change-notes/released/0.4.6.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
---
2-
category: fix
3-
---
1+
## 0.4.6
2+
3+
### Bug Fixes
4+
45
* The query `actions/code-injection/medium` now produces alerts for injection
5-
vulnerabilities on `pull_request` events.
6+
vulnerabilities on `pull_request` events.

‎actions/ql/lib/codeql-pack.release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.5
2+
lastReleaseVersion: 0.4.6

‎actions/ql/lib/codeql/actions/config/Config.qll

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,3 +154,13 @@ predicate untrustedGitCommandDataModel(string cmd_regex, string flag) {
154154
predicate untrustedGhCommandDataModel(string cmd_regex, string flag) {
155155
Extensions::untrustedGhCommandDataModel(cmd_regex, flag)
156156
}
157+
158+
/**
159+
* MaD models for permissions needed by actions
160+
* Fields:
161+
* - action: action name, e.g. `actions/checkout`
162+
* - permission: permission name, e.g. `contents: read`
163+
*/
164+
predicate actionsPermissionsDataModel(string action, string permission) {
165+
Extensions::actionsPermissionsDataModel(action, permission)
166+
}

‎actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,3 +77,14 @@ extensible predicate untrustedGitCommandDataModel(string cmd_regex, string flag)
7777
* Holds for gh commands that may introduce untrusted data
7878
*/
7979
extensible predicate untrustedGhCommandDataModel(string cmd_regex, string flag);
80+
81+
/**
82+
* Holds if `action` needs `permission` to run.
83+
* - 'action' is the name of the action without any version information.
84+
* E.g. for the action selector `actions/checkout@v2`, `action` is `actions/checkout`.
85+
* - `permission` is of the form `scope-name: read|write`, for example `contents: read`.
86+
* - see https://github.com/actions/checkout?tab=readme-ov-file#recommended-permissions
87+
* for an example of recommended permissions.
88+
* - see https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token for documentation of token permissions.
89+
*/
90+
extensible predicate actionsPermissionsDataModel(string action, string permission);

‎actions/ql/lib/ext/config/actions_permissions.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/actions-all
4+
extensible: actionsPermissionsDataModel
5+
data:
6+
- ["actions/checkout", "contents: read"]
7+
- ["actions/setup-node", "contents: read"]
8+
- ["actions/setup-python", "contents: read"]
9+
- ["actions/setup-java", "contents: read"]
10+
- ["actions/setup-go", "contents: read"]
11+
- ["actions/setup-dotnet", "contents: read"]
12+
- ["actions/labeler", "contents: read"]
13+
- ["actions/labeler", "pull-requests: write"]
14+
- ["actions/attest", "id-token: write"]
15+
- ["actions/attest", "attestations: write"]
16+
# No permissions needed for actions/add-to-project
17+
- ["actions/dependency-review-action", "contents: read"]
18+
- ["actions/attest-sbom", "id-token: write"]
19+
- ["actions/attest-sbom", "attestations: write"]
20+
- ["actions/stale", "contents: write"]
21+
- ["actions/stale", "issues: write"]
22+
- ["actions/stale", "pull-requests: write"]
23+
- ["actions/attest-build-provenance", "id-token: write"]
24+
- ["actions/attest-build-provenance", "attestations: write"]
25+
- ["actions/jekyll-build-pages", "contents: read"]
26+
- ["actions/jekyll-build-pages", "pages: write"]
27+
- ["actions/jekyll-build-pages", "id-token: write"]
28+
- ["actions/publish-action", "contents: write"]
29+
- ["actions/versions-package-tools", "contents: read"]
30+
- ["actions/versions-package-tools", "actions: read"]
31+
- ["actions/reusable-workflows", "contents: read"]
32+
- ["actions/reusable-workflows", "actions: read"]
33+
# TODO: Add permissions for actions/download-artifact
34+
# TODO: Add permissions for actions/upload-artifact
35+
# TODO: Add permissions for actions/cache
36+
37+

‎actions/ql/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.6-dev
2+
version: 0.4.7-dev
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

‎actions/ql/src/CHANGELOG.md

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
## 0.5.3
2+
3+
### Bug Fixes
4+
5+
* Fixed typos in the query and alert titles for the queries
6+
`actions/envpath-injection/critical`, `actions/envpath-injection/medium`,
7+
`actions/envvar-injection/critical`, and `actions/envvar-injection/medium`.
8+
19
## 0.5.2
210

311
No user-facing changes.
@@ -7,9 +15,10 @@ No user-facing changes.
715
### Bug Fixes
816

917
* The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
10-
Immutable Actions feature is not yet available for customer use. The query remains in the
11-
default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is
12-
available, the query will be updated to report alerts again.
18+
Immutable Actions feature is not yet available for customer use. The query has also been moved
19+
to the experimental folder and will not be used in code scanning unless it is explicitly added
20+
to a code scanning configuration. Once the Immutable Actions feature is available, the query will
21+
be updated to report alerts again.
1322

1423
## 0.5.0
1524

‎actions/ql/src/Security/CWE-1395/UseOfKnownVulnerableAction.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* @name Use of a known vulnerable action.
2+
* @name Use of a known vulnerable action
33
* @description The workflow is using an action with known vulnerabilities.
44
* @kind problem
55
* @problem.severity error

0 commit comments

Comments
 (0)