Paolo Tranquilli
b67644c127
Merge pull request #21986 from JarLob/userpermissions
...
Actions: Fix dominates() false positive in reusable workflows
2026-06-25 14:44:17 +02:00
Paolo Tranquilli
4b8cb3ffac
Fix false negative for branching nested reusable workflows
...
The previous fix required all outermost callers of a reusable workflow to
be protected, which collapsed distinct safe/unsafe inner paths that share
the same outermost caller. Track protection per caller chain instead: a
node inside a reusable workflow is only considered protected if there is
no unprotected caller path up to an outer workflow.
Adds a branching nested regression test where one inner job is protected
by a permission check and a sibling inner job is not.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-06-24 18:22:01 +02:00
Jaroslav Lobačevski
e2347a5c7d
Fix for independent checks
2026-06-23 11:52:11 +00:00
Jaroslav Lobačevski
2d6feb1255
Fix false negatives when one of the jobs had proper checks and the other didn't
2026-06-18 12:02:56 +00:00
Jaroslav Lobačevski
d51a9a3e1a
Support nested reusable workflows
2026-06-15 06:52:13 +00:00
Jaroslav Lobačevski
2eed6c1736
Fix dominates() false positive in reusable workflows
2026-06-15 05:42:59 +00:00
Henry Mercer
f4dc86e645
Correct query metadata for actions/untrusted-checkout/medium
2026-06-04 19:12:02 +01:00
Kristen Newbury
5503140318
Merge branch 'main' into knewbury01/adjust-actions-queries-untrusted-checkout-second-iteration
2026-05-21 10:49:36 -04:00
Kristen Newbury
a094a8e460
Fix merge conflicts
2026-05-21 10:48:24 -04:00
Owen Mansel-Chan
2280955136
Merge pull request #21800 from knewbury01/knewbury01/adjust-actions-queries-untrusted-checkout-critical-alert
...
Actions: Adjust alert location UntrustedCheckoutCritical
2026-05-21 12:40:29 +01:00
Owen Mansel-Chan
ad69cfb721
Merge pull request #21838 from github/copilot/widen-regex-for-pinned-actions
...
Align `alphaNumericRegex()` with the documented grouped SHA pattern
2026-05-18 17:35:27 +01:00
Kristen Newbury
3eaf04ef72
Fix expected files for changes to alert messages UntrustedCheckoutCritical and UntrustedCheckoutHigh
2026-05-14 15:05:08 -04:00
Owen Mansel-Chan
2067113177
Update expected test output
2026-05-12 22:40:03 +01:00
copilot-swe-agent[bot]
ef1bde7565
Widen pinned SHA regex to support SHA-256 (64-char hex) and add tests
2026-05-12 22:40:03 +01:00
Kristen Newbury
3f44a23cf2
Adjust alert location UntrustedCheckoutCritical
2026-05-05 13:35:52 -04:00
Óscar San José
e598c56c64
update and fix tests
2026-04-20 12:38:06 +02:00
copilot-swe-agent[bot]
ec12035ac2
Extend unpinned-tag query to scan composite action metadata
...
Agent-Logs-Url: https://github.com/github/codeql/sessions/c52790be-00f6-4250-b46b-38c05365ddd7
Co-authored-by: oscarsj <1410188+oscarsj@users.noreply.github.com >
2026-04-10 11:20:36 +00:00
Kristen Newbury
7b7411f7df
Change alert location CWE-829/ArtifactPoisoning queries
2026-04-08 08:57:45 -04:00
Kristen Newbury
41714656ec
Adjust alert messages actions CWE-829
2026-04-02 11:58:58 -04:00
Adnan Khan
07598e8b62
Add test results.
2025-07-11 05:59:13 +00:00
AdnaneKhan
1b794e056a
Add extra test suggested by @Napalys
2025-07-10 12:24:36 -04:00
Adnan Khan
e40e4c3856
Remove unneeded test file.
2025-07-09 23:06:18 -04:00
Jaroslav Lobačevski
9393181c4e
Add tests and path normalization fix to handle $ expansion
2025-07-08 16:18:12 +00:00
AdnaneKhan
5d6a5d5cbb
Add change notes and test workflow file.
2025-07-08 10:35:39 -04:00
Andrew Eisenberg
2a0e133768
Move UnversionedImmutableAction.ql to experimental
...
This query will give too many false positives for users until
immutable actions is released.
2025-03-06 15:08:02 -08:00
martincostello
31913c4a55
Fix test
...
Fix failing test.
2025-02-14 19:46:46 +00:00
Martin Costello
9a29cebe58
Fix docker SHA false positive
...
Fix false positives for pinned Docker container images.
2025-02-14 12:35:55 +00:00
Dave Bartolomeo
e2ab65ea3e
Update qlref paths
2025-02-06 11:20:19 -05:00
Jaroslav Lobačevski
83d13c6f20
Fix lower range for known vulnerable actions
2025-01-22 17:30:19 +01:00
Óscar San José
b39bfdbb04
Upgrade workflows to ubuntu-24
2025-01-17 11:22:15 +01:00
Dave Bartolomeo
ee7680df84
Move into actions subdirectory to prepare for migration to github/codeql
2024-12-18 14:35:15 -05:00
