78 Commits

Author	SHA1	Message	Date
Arthur Baars	0e23b86bf5	Merge pull request #19182 from github/post-release-prep/codeql-cli-2.21.0 ... Post-release preparation for codeql-cli-2.21.0	2025-04-01 15:12:29 +02:00
Marco Gario	d33ce423d8	Update UntrustedCheckoutCritical.ql	2025-04-01 13:58:37 +02:00
github-actions[bot]	10205cb990	Post-release preparation for codeql-cli-2.21.0	2025-04-01 11:30:43 +00:00
Marco Gario	c0d7288696	Merge branch 'main' into marcogario-patch-1	2025-04-01 10:59:03 +02:00
Andrew Eisenberg	70150eea9a	Merge branch 'main' into marcogario/untrusted_checkout_name	2025-03-31 13:54:17 -07:00
Marco Gario	820dacd151	Merge branch 'main' into marcogario-patch-1	2025-03-31 20:42:12 +02:00
Marco Gario	8737acb6a9	Update actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql ... Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>	2025-03-31 20:42:03 +02:00
github-actions[bot]	84f6564cc0	Release preparation for version 2.21.0	2025-03-31 17:35:15 +00:00
Tamas Vajk	34e8318797	Rename the CCR query suite to code-quality	2025-03-27 08:36:53 +01:00
Marco Gario	288fcb6092	Update CWE-829 description for clarity	2025-03-26 15:53:20 +01:00
Marco Gario	b1737858fa	UntrustedCheckout: Try and differentiate between two versions of the rule	2025-03-26 12:49:48 +00:00
Marco Gario	29a23a3d20	Update UseOfKnownVulnerableAction.ql ... Name should not end in a `.`	2025-03-26 13:28:34 +01:00
Chris Smowton	9a2a13ed55	Merge remote-tracking branch 'origin/main' into smowton/admin/merge-rc317-into-main	2025-03-19 16:01:29 +00:00
github-actions[bot]	51cdeefafb	Post-release preparation for codeql-cli-2.20.7	2025-03-17 13:00:41 +00:00
github-actions[bot]	2d64a618e6	Release preparation for version 2.20.7	2025-03-17 12:15:54 +00:00
Aditya Sharad	956b5bf6d6	Actions: Fix typos in query names for env var injection ... This will reflect in the UI titles of existing and new alerts once shipped but should not churn any existing alerts.	2025-03-13 17:02:04 -07:00
Andrew Eisenberg	02051ff7b1	Update the security experimental suite	2025-03-12 11:46:03 -07:00
Andrew Eisenberg	cd63e7cf54	Fix the actions-security-and-quality.qls suite ... It was not using the proper selectors. It is now the same as other quality suites in other languages.	2025-03-12 11:43:59 -07:00
Arthur Baars	b2e0eaf664	Merge pull request #18965 from JarLob/docs ... Minor example workflow fix	2025-03-12 11:17:42 +01:00
Remco Vermeulen	8f603251d7	Add missing dependency ... The query pack has suites that rely on the `codeql/suite-helpers` pack, but doesn't include it as a dependency. This will cause error when resolving suites referring the Actions query pack.	2025-03-10 18:31:01 -07:00
Jaroslav Lobačevski	fa35d6c3ac	Minor example workflow fix	2025-03-10 20:43:16 +00:00
Andrew Eisenberg	2a0e133768	Move UnversionedImmutableAction.ql to experimental ... This query will give too many false positives for users until immutable actions is released.	2025-03-06 15:08:02 -08:00
github-actions[bot]	58f355ae5a	Post-release preparation for codeql-cli-2.20.6	2025-03-03 18:18:15 +00:00
github-actions[bot]	fa850cccb1	Release preparation for version 2.20.6	2025-03-03 17:13:19 +00:00
Dave Bartolomeo	4e47da463e	Add change note	2025-02-27 12:04:09 -05:00
github-actions[bot]	ad24f94a77	Post-release preparation for codeql-cli-2.20.5	2025-02-17 17:58:24 +00:00
github-actions[bot]	6f4562f3bd	Release preparation for version 2.20.5	2025-02-17 16:55:54 +00:00
martincostello	f1723321fa	Format Document ... Fix lint warning.	2025-02-14 18:06:00 +00:00
Martin Costello	979d604bf6	Apply suggestions from code review ... Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>	2025-02-14 17:21:24 +00:00
martincostello	5d2409e652	Fix query ... Forgot to move the `and`.	2025-02-14 13:36:09 +00:00
martincostello	9a7ed7f3f7	Re-order conditions ... Makes for a neater diff.	2025-02-14 13:35:20 +00:00
martincostello	99bb0f0b4f	Use if then else ... Apply code review suggestion. Co-Authored-By: Taus <1104778+tausbn@users.noreply.github.com>	2025-02-14 13:30:55 +00:00
martincostello	cf8abb7989	Add change note ... Add change note.	2025-02-14 13:27:36 +00:00
martincostello	71bc89beda	Fix query ... Fix various issues with the query.	2025-02-14 12:59:02 +00:00
Martin Costello	9a29cebe58	Fix docker SHA false positive ... Fix false positives for pinned Docker container images.	2025-02-14 12:35:55 +00:00
Dave Bartolomeo	0b2e307f9a	Merge pull request #18705 from github/dbartol/actions-suite-selectors ... Use default query selectors for Actions suites	2025-02-07 14:06:00 -05:00
Dave Bartolomeo	0e4725bfe2	Merge pull request #18435 from felickz/felickz/actions-trusted-owner-data-extensions ... Convert trusted actions list to data extension	2025-02-07 10:25:41 -05:00
Dave Bartolomeo	3b02f4d7bc	Update change note	2025-02-07 10:09:31 -05:00
Dave Bartolomeo	42562b5187	Merge pull request #18704 from github/dbartol/actions-suites ... Actions: Move experimental queries to `experimental` directory	2025-02-07 10:03:31 -05:00
Dave Bartolomeo	ca7bcc9714	Add change note	2025-02-06 11:50:59 -05:00
Dave Bartolomeo	cb7aeea516	Use standard query selectors for actions-code-scanning and actions-security-extended	2025-02-06 11:34:43 -05:00
Dave Bartolomeo	74619d49b3	Update precision and severity for unpinned-tag ... This ensures that it will be in `security-extended`, but not the default suite.	2025-02-06 11:33:17 -05:00
Dave Bartolomeo	81ff4dd81c	Update severity for excessive-secrets-exposure ... This ensures that it will remain in the default suite.	2025-02-06 11:32:32 -05:00
Dave Bartolomeo	d7259c17db	Add security tag for missing-actions-permissions ... This ensures that it will remain in the default suite.	2025-02-06 11:31:36 -05:00
Dave Bartolomeo	909de5280c	Update severity and precision of a few injection queries ... These will wind up in `security-extended`, when previously they were not in any of the standard suites.	2025-02-06 11:30:43 -05:00
Dave Bartolomeo	604dbfd0d0	Actions: Move experimental to experimental directory ... This is consistent with how other languages manage experimental queries. I've left the `experimental` tags in place.	2025-02-06 10:54:25 -05:00
Remco Vermeulen	9894e9ef9f	Add CCR suites	2025-02-05 01:58:34 +00:00
github-actions[bot]	f1b05a79a4	Post-release preparation for codeql-cli-2.20.4	2025-02-04 09:25:09 +00:00
github-actions[bot]	573e53e454	Release preparation for version 2.20.4	2025-02-03 15:19:35 +00:00
github-actions[bot]	fbb7f0a0c6	Post-release preparation for codeql-cli-2.20.2	2025-01-20 21:11:14 +00:00