Skip to content

Commit ffe700c

Browse files
author
Alvaro Muñoz
authored
Merge pull request #68 from github/cat_env
feat(bash): Add support for `cat hazelcast/.github/java-config.env >> $GITHUB_ENV`
2 parents 90efdc7 + 8cf1a6a commit ffe700c

File tree

7 files changed

+158
-54
lines changed

7 files changed

+158
-54
lines changed

‎ql/lib/codeql/actions/Helper.qll

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,32 @@ predicate writeToGitHubPath(Run run, string content) {
212212
extractFileWrite(run.getScript(), "GITHUB_PATH", content)
213213
}
214214

215+
/** Writes the content of the file specified by `path` into a file pointed to by `file_var` */
216+
bindingset[script, file_var]
217+
predicate fileToFileWrite(string script, string file_var, string path) {
218+
exists(string regexp, string line, string file_expr |
219+
isBashParameterExpansion(file_expr, file_var, _, _) and
220+
regexp =
221+
"(?i)(cat)\\s*" + "((?:(?!<<|<<-)[^>\n])+)\\s*" +
222+
"(>>|>|\\s*\\|\\s*tee\\s*(-a|--append)?)\\s*" + "(\\S+)" and
223+
line = script.splitAt("\n") and
224+
path = line.regexpCapture(regexp, 2) and
225+
file_expr = trimQuotes(line.regexpCapture(regexp, 5))
226+
)
227+
}
228+
229+
predicate fileToGitHubEnv(Run run, string path) {
230+
fileToFileWrite(run.getScript(), "GITHUB_ENV", path)
231+
}
232+
233+
predicate fileToGitHubOutput(Run run, string path) {
234+
fileToFileWrite(run.getScript(), "GITHUB_OUTPUT", path)
235+
}
236+
237+
predicate fileToGitHubPath(Run run, string path) {
238+
fileToFileWrite(run.getScript(), "GITHUB_PATH", path)
239+
}
240+
215241
predicate inPrivilegedCompositeAction(AstNode node) {
216242
exists(CompositeAction a |
217243
a = node.getEnclosingCompositeAction() and

‎ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll

Lines changed: 28 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ private import actions
22
private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
private import codeql.actions.security.ArtifactPoisoningQuery
5+
private import codeql.actions.security.UntrustedCheckoutQuery
56
private import codeql.actions.dataflow.FlowSteps
67
import codeql.actions.DataFlow
78
import codeql.actions.dataflow.FlowSources
@@ -16,27 +17,39 @@ abstract class EnvPathInjectionSink extends DataFlow::Node { }
1617
*/
1718
class EnvPathInjectionFromFileReadSink extends EnvPathInjectionSink {
1819
EnvPathInjectionFromFileReadSink() {
19-
exists(Run run, UntrustedArtifactDownloadStep step, string value |
20+
exists(Run run, Step step |
21+
(
22+
step instanceof UntrustedArtifactDownloadStep or
23+
step instanceof PRHeadCheckoutStep
24+
) and
2025
this.asExpr() = run.getScriptScalar() and
2126
step.getAFollowingStep() = run and
22-
writeToGitHubPath(run, value) and
2327
(
24-
outputsPartialFileContent(value)
25-
or
2628
// e.g.
27-
// FOO=$(cat test-results/sha-number)
28-
// echo "FOO=$FOO" >> $GITHUB_PATH
29-
exists(string line, string var_name, string var_value |
30-
run.getScript().splitAt("\n") = line
31-
|
32-
var_name = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 1) and
33-
var_value = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 2) and
34-
outputsPartialFileContent(var_value) and
29+
// cat test-results/.env >> $GITHUB_PATH
30+
fileToGitHubPath(run, _)
31+
or
32+
exists(string value |
33+
writeToGitHubPath(run, value) and
3534
(
36-
value.matches("%$" + ["", "{", "ENV{"] + var_name + "%")
35+
outputsPartialFileContent(value)
3736
or
38-
value.regexpMatch("\\$\\((echo|printf|write-output)\\s+.*") and
39-
value.indexOf(var_name) > 0
37+
// e.g.
38+
// FOO=$(cat test-results/sha-number)
39+
// echo "FOO=$FOO" >> $GITHUB_PATH
40+
exists(string line, string var_name, string var_value |
41+
run.getScript().splitAt("\n") = line
42+
|
43+
var_name = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 1) and
44+
var_value = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 2) and
45+
outputsPartialFileContent(var_value) and
46+
(
47+
value.matches("%$" + ["", "{", "ENV{"] + var_name + "%")
48+
or
49+
value.regexpMatch("\\$\\((echo|printf|write-output)\\s+.*") and
50+
value.indexOf(var_name) > 0
51+
)
52+
)
4053
)
4154
)
4255
)

‎ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

Lines changed: 32 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ private import actions
22
private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
private import codeql.actions.security.ArtifactPoisoningQuery
5+
private import codeql.actions.security.UntrustedCheckoutQuery
56
private import codeql.actions.dataflow.FlowSteps
67
import codeql.actions.DataFlow
78
import codeql.actions.dataflow.FlowSources
@@ -12,33 +13,48 @@ abstract class EnvVarInjectionSink extends DataFlow::Node { }
1213
* Holds if a Run step declares an environment variable with contents from a local file.
1314
* e.g.
1415
* run: |
16+
* cat test-results/.env >> $GITHUB_ENV
1517
* echo "sha=$(cat test-results/sha-number)" >> $GITHUB_ENV
1618
* echo "sha=$(<test-results/sha-number)" >> $GITHUB_ENV
1719
*/
1820
class EnvVarInjectionFromFileReadSink extends EnvVarInjectionSink {
1921
EnvVarInjectionFromFileReadSink() {
20-
exists(Run run, UntrustedArtifactDownloadStep step, string content, string value |
22+
exists(Run run, Step step |
23+
(
24+
step instanceof UntrustedArtifactDownloadStep or
25+
step instanceof PRHeadCheckoutStep
26+
) and
2127
this.asExpr() = run.getScriptScalar() and
2228
step.getAFollowingStep() = run and
23-
writeToGitHubEnv(run, content) and
24-
extractVariableAndValue(content, _, value) and
2529
(
26-
outputsPartialFileContent(value)
27-
or
2830
// e.g.
29-
// FOO=$(cat test-results/sha-number)
30-
// echo "FOO=$FOO" >> $GITHUB_ENV
31-
exists(string line, string var_name, string var_value |
32-
run.getScript().splitAt("\n") = line
33-
|
34-
var_name = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 1) and
35-
var_value = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 2) and
36-
outputsPartialFileContent(var_value) and
31+
// cat test-results/.env >> $GITHUB_ENV
32+
fileToGitHubEnv(run, _)
33+
or
34+
exists(string content, string value |
35+
writeToGitHubEnv(run, content) and
36+
extractVariableAndValue(content, _, value) and
3737
(
38-
value.matches("%$" + ["", "{", "ENV{"] + var_name + "%")
38+
// e.g.
39+
// echo "FOO=$(cat test-results/sha-number)" >> $GITHUB_ENV
40+
outputsPartialFileContent(value)
3941
or
40-
value.regexpMatch("\\$\\((echo|printf|write-output)\\s+.*") and
41-
value.indexOf(var_name) > 0
42+
// e.g.
43+
// FOO=$(cat test-results/sha-number)
44+
// echo "FOO=$FOO" >> $GITHUB_ENV
45+
exists(string line, string var_name, string var_value |
46+
run.getScript().splitAt("\n") = line
47+
|
48+
var_name = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 1) and
49+
var_value = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 2) and
50+
outputsPartialFileContent(var_value) and
51+
(
52+
value.matches("%$" + ["", "{", "ENV{"] + var_name + "%")
53+
or
54+
value.regexpMatch("\\$\\((echo|printf|write-output)\\s+.*") and
55+
value.indexOf(var_name) > 0
56+
)
57+
)
4258
)
4359
)
4460
)

‎ql/lib/codeql/actions/security/OutputClobberingQuery.qll

Lines changed: 37 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ private import actions
22
private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
private import codeql.actions.security.ArtifactPoisoningQuery
5+
private import codeql.actions.security.UntrustedCheckoutQuery
56
private import codeql.actions.dataflow.FlowSteps
67
import codeql.actions.DataFlow
78
import codeql.actions.dataflow.FlowSources
@@ -12,40 +13,53 @@ abstract class OutputClobberingSink extends DataFlow::Node { }
1213
* Holds if a Run step declares an environment variable with contents from a local file.
1314
* e.g.
1415
* run: |
16+
* cat test-results/.vars >> $GITHUB_OUTPUT
1517
* echo "sha=$(cat test-results/sha-number)" >> $GITHUB_OUTPUT
1618
* echo "sha=$(<test-results/sha-number)" >> $GITHUB_OUTPUT
1719
*/
1820
class OutputClobberingFromFileReadSink extends OutputClobberingSink {
1921
OutputClobberingFromFileReadSink() {
20-
exists(Run run, UntrustedArtifactDownloadStep step, string content, string key, string value |
22+
exists(Run run, Step step |
23+
(
24+
step instanceof UntrustedArtifactDownloadStep or
25+
step instanceof PRHeadCheckoutStep
26+
) and
2127
this.asExpr() = run.getScriptScalar() and
2228
step.getAFollowingStep() = run and
23-
writeToGitHubOutput(run, content) and
24-
extractVariableAndValue(content, key, value) and
25-
// there is a different output variable in the same script
26-
// TODO: key2/value2 should be declared before key/value
27-
exists(string content2, string key2 |
28-
writeToGitHubOutput(run, content2) and
29-
extractVariableAndValue(content2, key2, _) and
30-
not key2 = key
31-
) and
3229
(
33-
outputsPartialFileContent(value)
34-
or
3530
// e.g.
36-
// FOO=$(cat test-results/sha-number)
37-
// echo "FOO=$FOO" >> $GITHUB_OUTPUT
38-
exists(string line, string var_name, string var_value |
39-
run.getScript().splitAt("\n") = line
40-
|
41-
var_name = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 1) and
42-
var_value = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 2) and
43-
outputsPartialFileContent(var_value) and
31+
// cat test-results/.vars >> $GITHUB_OUTPUT
32+
fileToGitHubOutput(run, _)
33+
or
34+
exists(string content, string key, string value |
35+
writeToGitHubOutput(run, content) and
36+
extractVariableAndValue(content, key, value) and
37+
// there is a different output variable in the same script
38+
// TODO: key2/value2 should be declared before key/value
39+
exists(string content2, string key2 |
40+
writeToGitHubOutput(run, content2) and
41+
extractVariableAndValue(content2, key2, _) and
42+
not key2 = key
43+
) and
4444
(
45-
value.matches("%$" + ["", "{", "ENV{"] + var_name + "%")
45+
outputsPartialFileContent(value)
4646
or
47-
value.regexpMatch("\\$\\((echo|printf|write-output)\\s+.*") and
48-
value.indexOf(var_name) > 0
47+
// e.g.
48+
// FOO=$(cat test-results/sha-number)
49+
// echo "FOO=$FOO" >> $GITHUB_OUTPUT
50+
exists(string line, string var_name, string var_value |
51+
run.getScript().splitAt("\n") = line
52+
|
53+
var_name = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 1) and
54+
var_value = line.regexpCapture("([a-zA-Z0-9\\-_]+)=(.*)", 2) and
55+
outputsPartialFileContent(var_value) and
56+
(
57+
value.matches("%$" + ["", "{", "ENV{"] + var_name + "%")
58+
or
59+
value.regexpMatch("\\$\\((echo|printf|write-output)\\s+.*") and
60+
value.indexOf(var_name) > 0
61+
)
62+
)
4963
)
5064
)
5165
)

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test10.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Build and Dockerize
2+
3+
on:
4+
pull_request_target:
5+
6+
jobs:
7+
build:
8+
name: Test
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Decide Which 'ref' To Checkout
12+
id: decide-ref
13+
run: |
14+
if [[ "${{github.event_name}}" == "pull_request_target" ]]; then
15+
echo "ref=refs/pull/${{ github.event.pull_request.number }}/merge" >> $GITHUB_OUTPUT
16+
else
17+
echo "ref=${{github.ref}}" >> $GITHUB_OUTPUT
18+
fi
19+
20+
- name: Checkout
21+
uses: actions/checkout@v4
22+
with:
23+
ref: ${{steps.decide-ref.outputs.ref}}
24+
path: "foo"
25+
26+
- name: Read Java Config
27+
run: cat foo/.github/java-config.env >> $GITHUB_ENV
28+

‎ql/test/query-tests/Security/CWE-077/EnvVarInjectionCritical.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ edges
1919
| .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:37:14:38:82 | echo "foo=$(cat ./artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | provenance | |
2020
| .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | provenance | |
2121
| .github/workflows/test9.yml:19:9:27:6 | Uses Step | .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | provenance | |
22+
| .github/workflows/test10.yml:20:9:26:6 | Uses Step | .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | provenance | |
2223
nodes
2324
| .github/workflows/test2.yml:12:9:41:6 | Uses Step | semmle.label | Uses Step |
2425
| .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | semmle.label | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n |
@@ -58,6 +59,8 @@ nodes
5859
| .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | semmle.label | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n |
5960
| .github/workflows/test9.yml:19:9:27:6 | Uses Step | semmle.label | Uses Step |
6061
| .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | semmle.label | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n |
62+
| .github/workflows/test10.yml:20:9:26:6 | Uses Step | semmle.label | Uses Step |
63+
| .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | semmle.label | cat foo/.github/java-config.env >> $GITHUB_ENV |
6164
subpaths
6265
#select
6366
| .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | .github/workflows/test2.yml:12:9:41:6 | Uses Step | .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n |
@@ -80,3 +83,4 @@ subpaths
8083
| .github/workflows/test8.yml:37:14:38:82 | echo "foo=$(cat ./artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:37:14:38:82 | echo "foo=$(cat ./artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test8.yml:37:14:38:82 | echo "foo=$(cat ./artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | echo "foo=$(cat ./artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n |
8184
| .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n |
8285
| .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | .github/workflows/test9.yml:19:9:27:6 | Uses Step | .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n |
86+
| .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | .github/workflows/test10.yml:20:9:26:6 | Uses Step | .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | cat foo/.github/java-config.env >> $GITHUB_ENV |

‎ql/test/query-tests/Security/CWE-077/EnvVarInjectionMedium.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ edges
1919
| .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:37:14:38:82 | echo "foo=$(cat ./artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | provenance | |
2020
| .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | provenance | |
2121
| .github/workflows/test9.yml:19:9:27:6 | Uses Step | .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | provenance | |
22+
| .github/workflows/test10.yml:20:9:26:6 | Uses Step | .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | provenance | |
2223
nodes
2324
| .github/workflows/test2.yml:12:9:41:6 | Uses Step | semmle.label | Uses Step |
2425
| .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | semmle.label | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n |
@@ -58,5 +59,7 @@ nodes
5859
| .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | semmle.label | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n |
5960
| .github/workflows/test9.yml:19:9:27:6 | Uses Step | semmle.label | Uses Step |
6061
| .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | semmle.label | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n |
62+
| .github/workflows/test10.yml:20:9:26:6 | Uses Step | semmle.label | Uses Step |
63+
| .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | semmle.label | cat foo/.github/java-config.env >> $GITHUB_ENV |
6164
subpaths
6265
#select

0 commit comments

Comments
 (0)