test: Add tests

Author: Alvaro Muñoz

.gitignore

@@ -2,3 +2,4 @@
 **/*.testproj
 ql/lib/.codeql/
 ql/src/.codeql/
+ql/test/.codeql/

build-test-dbs.sh

@@ -1,3 +1,4 @@
 provide:
   - "**/ql/src/qlpack.yml"
-  - "**/ql/lib/qlpack.yml"
+  - "**/ql/lib/qlpack.yml"
+  - "**/ql/test/qlpack.yml"

codeql-workspace.yml

@@ -270,7 +270,12 @@ class StepUsesExpr extends StepStmt, UsesExpr {
 
   override string getCallee() { result = uses.getGitHubRepository() }
 
-  override string getVersion() { result = uses.getVersion() }
+  override string getVersion() {
+    result = uses.getVersion()
+    or
+    not exists(uses.getVersion()) and
+    result = "main"
+  }
 
   override Expression getArgumentExpr(string key) {
     exists(Actions::With with |

ql/lib/codeql/actions/Ast.qll

@@ -6,7 +6,6 @@
 import codeql.actions.ast.internal.Yaml
 import codeql.files.FileSystem
 
-// ALVARO: Make it private
 /**
  * Libraries for modeling GitHub Actions workflow files written in YAML.
  * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
@@ -376,7 +375,6 @@ module Actions {
   }
 
   /**
-   * ALVARO
    * https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idneeds
    */
   class Needs extends YamlNode {

ql/lib/codeql/actions/ast/internal/Actions.qll

@@ -10,7 +10,6 @@ dependencies:
   codeql/dataflow: ^0.1.7
 dbscheme: yaml.dbscheme
 extractor: yaml
-tests: test
 groups:
   - yaml
 dataExtensions:

ql/lib/qlpack.yml

@@ -24,15 +24,15 @@ private predicate isTrustedOrg(string repo) {
 from StepUsesExpr uses, string repo, string version, WorkflowStmt workflow, string name
 where
   uses.getCallee() = repo and
-  uses.getVersion() = version and
   uses.getEnclosingWorkflowStmt() = workflow and
   (
     workflow.getName() = name
     or
     not exists(workflow.getName()) and workflow.getLocation().getFile().getBaseName() = name
   ) and
-  not isPinnedCommit(version) and
-  not isTrustedOrg(repo)
+  uses.getVersion() = version and
+  not isTrustedOrg(repo) and
+  not isPinnedCommit(version)
 select uses,
   "Unpinned 3rd party Action '" + name + "' step $@ uses '" + repo + "' with ref '" + version +
     "', not a pinned commit hash", uses, uses.toString()

ql/src/Security/CWE-020/CompositeActionSummaries.ql renamed to ql/src/Security/CWE-020/CompositeActionsSummaries.ql

@@ -10,7 +10,7 @@
  * @id actions/untrusted-checkout
  * @tags actions
  *       security
- *       external/cwe/cwe-094
+ *       external/cwe/cwe-829
  */
 
 import actions