From 8a904a2af004e1c33bc2cda181edfc74413957b6 Mon Sep 17 00:00:00 2001
From: sailikhith-stepsecurity <sailikhith@stepsecurity.io>
Date: Wed, 22 Jan 2025 11:41:39 +0530
Subject: [PATCH] updating action name while getting image manifest for bundled
 actions

---
 .../workflow/pin/action_image_manifest.go     | 10 +++++++++-
 remediation/workflow/pin/pinactions_test.go   | 19 ++++++++++++++++++-
 .../pinactions/input/immutableaction-1.yml    |  3 ++-
 .../pinactions/output/immutableaction-1.yml   |  1 +
 4 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/remediation/workflow/pin/action_image_manifest.go b/remediation/workflow/pin/action_image_manifest.go
index f7c48e291..16e3a1ad8 100644
--- a/remediation/workflow/pin/action_image_manifest.go
+++ b/remediation/workflow/pin/action_image_manifest.go
@@ -69,6 +69,14 @@ func getOCIImageArtifactTypeForGhAction(action string) (string, error) {
 		return "", fmt.Errorf("invalid action format")
 	}
 
+	// For bundled actions like github/codeql-action/analyze@v3,
+	// we only need the repository part (github/codeql-action) to check for immutability
+	actionPath := parts[0]
+	if strings.Count(parts[0], "/") > 1 {
+		pathParts := strings.Split(parts[0], "/")
+		actionPath = strings.Join(pathParts[:2], "/")
+	}
+
 	// convert v1.x.x to 1.x.x which is
 	// use regexp to match tag version format and replace v in prefix
 	// as immutable actions image tag is in format 1.x.x (without v prefix)
@@ -79,7 +87,7 @@ func getOCIImageArtifactTypeForGhAction(action string) (string, error) {
 	}
 
 	// Convert GitHub action to GHCR image reference using proper OCI reference format
-	image := fmt.Sprintf("ghcr.io/%s:%s", parts[0], parts[1])
+	image := fmt.Sprintf("ghcr.io/%s:%s", actionPath, parts[1])
 	imageManifest, err := getOCIManifestForImage(image)
 	if err != nil {
 		return "", err
diff --git a/remediation/workflow/pin/pinactions_test.go b/remediation/workflow/pin/pinactions_test.go
index ef20695d6..3e7c0ef8b 100644
--- a/remediation/workflow/pin/pinactions_test.go
+++ b/remediation/workflow/pin/pinactions_test.go
@@ -173,6 +173,21 @@ func TestPinActions(t *testing.T) {
 				  }
 			]`))
 
+	httpmock.RegisterResponder("GET", "https://api.github.com/repos/github/codeql-action/commits/v3",
+		httpmock.NewStringResponder(200, `d68b2d4edb4189fd2a5366ac14e72027bd4b37dd`))
+
+	httpmock.RegisterResponder("GET", "https://api.github.com/repos/github/codeql-action/git/matching-refs/tags/v3.",
+		httpmock.NewStringResponder(200,
+			`[
+				{
+					"ref": "refs/tags/v3.28.2",
+					"object": {
+					  "sha": "d68b2d4edb4189fd2a5366ac14e72027bd4b37dd",
+					  "type": "commit"
+					}
+				  }
+			]`))
+
 	// mock ping response
 	httpmock.RegisterResponder("GET", "https://ghcr.io/v2/",
 		httpmock.NewStringResponder(200, ``))
@@ -191,7 +206,8 @@ func TestPinActions(t *testing.T) {
 				"repository:JS-DevTools/npm-publish:pull",
 				"repository:elgohr/Publish-Docker-Github-Action:pull",
 				"repository:brandedoutcast/publish-nuget:pull",
-				"repository:rohith/publish-nuget:pull":
+				"repository:rohith/publish-nuget:pull",
+				"repository:github/codeql-action:pull":
 				return httpmock.NewJsonResponse(http.StatusOK, map[string]string{
 					"token":        "test-token",
 					"access_token": "test-token",
@@ -213,6 +229,7 @@ func TestPinActions(t *testing.T) {
 		// the following list will contain the list of actions with versions
 		// which are mocked to be immutable
 		"actions/checkout@v1.2.0",
+		"github/codeql-action@v3.28.2",
 	}
 
 	for _, action := range manifestResponders {
diff --git a/testfiles/pinactions/input/immutableaction-1.yml b/testfiles/pinactions/input/immutableaction-1.yml
index 41a6e0b94..3740d1637 100644
--- a/testfiles/pinactions/input/immutableaction-1.yml
+++ b/testfiles/pinactions/input/immutableaction-1.yml
@@ -4,7 +4,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v1.2.0
+    - uses: actions/checkout@v1
+    - uses: github/codeql-action/analyze@v3
     - uses: borales/actions-yarn@v2.3.0
       with:
         auth-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/testfiles/pinactions/output/immutableaction-1.yml b/testfiles/pinactions/output/immutableaction-1.yml
index a4a93961b..b007a0e7d 100644
--- a/testfiles/pinactions/output/immutableaction-1.yml
+++ b/testfiles/pinactions/output/immutableaction-1.yml
@@ -5,6 +5,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v1.2.0
+    - uses: github/codeql-action/analyze@v3.28.2
     - uses: borales/actions-yarn@4965e1a0f0ae9c422a9a5748ebd1fb5e097d22b9 # v2.3.0
       with:
         auth-token: ${{ secrets.GITHUB_TOKEN }}