hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make docs less verbose regarding codeql config + enhance changlog to highlight extensibility

Browse Source
This commit is contained in:
Chad Bentz
2025-01-09 19:30:02 -05:00
parent b144c2f597
commit 26074bb7fe
2 changed files with 1 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md
View File

@@ -1,4 +1,4 @@
---
category: feature
---
* Trusted Action owner list can now be expanded using data extensions for `trustedActionsOwnerDataModel` on the query `actions/unpinned-tag`
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a data extension model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner.

36
actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md
View File

@@ -8,42 +8,6 @@ Using a tag for a 3rd party Action that is not pinned to a commit can lead to ex
Pinning an action to a full length commit SHA is currently the only way to use a non-immutable action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
### Configuration
If there is an Action publisher that you trust, you can include the owner name/organization in a data extension model pack to add it to the allow list for this query. Adding owners to this list will prevent security alerts when using unpinned tags for Actions published by that owner.
#### Example
To allow any Action from the publisher `octodemo`, such as `octodemo/3rd-party-action`, follow these steps:
1. Create a data extension file `/models/trusted-owner.model.yml` with the following content:
```yaml
extensions:
- addsTo:
pack: codeql/actions-all
extensible: trustedActionsOwnerDataModel
data:
- ["octodemo"]
```
2. Create a model pack file `/codeql-pack.yml` with the following content:
```yaml
name: my-org/actions-extensions-model-pack
version: 0.0.0
library: true
extensionTargets:
codeql/actions-all: '*'
dataExtensions:
- models/**/*.yml
```
3. Ensure that the model pack is included in your CodeQL analysis.
By following these steps, you will add `octodemo` to the list of trusted Action publishers, and the query will no longer generate security alerts for unpinned tags from this publisher.
## Examples
### Incorrect Usage