441 Commits

Author	SHA1	Message	Date
Kylie Stradley	f8be8e768f	Merge branch 'master' into immutable-actions	2024-10-24 15:25:31 -04:00
Kylie Stradley	c9b1cd2c02	add workflow to catch some ineligible wildcards and eligible latest version for immutable actions	2024-10-23 21:18:04 -04:00
Alvaro Muñoz	dbcf113546	Bump qlpack versions	2024-10-23 22:04:01 +02:00
Alvaro Muñoz	b6a26e76d4	New azure models	2024-10-23 22:03:11 +02:00
Alvaro Muñoz	ae6309daf6	Account for tar -C option to specify path	2024-10-23 22:02:58 +02:00
Alvaro Muñoz	674afc5edd	Improve labelgate accuracy	2024-10-23 15:48:42 +02:00
Alvaro Muñoz	9a0795cc75	Bump qlpack versions	2024-10-23 12:16:32 +02:00
Alvaro Muñoz	315ffdff8d	Improve env var injection sanitizers	2024-10-23 12:15:54 +02:00
Alvaro Muñoz	fef37b6025	Remove pull_request from context event map so that accesss to github.event.pull_request are not considered a source for pull_request triggers	2024-10-23 12:15:26 +02:00
Alvaro Muñoz	c9bb42a46c	Enforce a checkout kind of trigger to consider gh pr/gh api ... pulls as a source of untrusted data	2024-10-23 12:14:20 +02:00
Alvaro Muñoz	6298f2520e	Bump qlpack versions	2024-10-23 10:37:33 +02:00
Alvaro Muñoz	d1d92ae68a	Create getATriggerEvent for Steps and refactor the code to use it	2024-10-23 10:13:20 +02:00
Alvaro Muñoz	b2a3aaacfd	Bump qlpack versions	2024-10-23 09:40:25 +02:00
Alvaro Muñoz	a057b9dd44	Add poisonable step for azure/powershell	2024-10-23 09:39:34 +02:00
Alvaro Muñoz	0738a66380	Add trigger event checks for all checkout models	2024-10-23 09:37:01 +02:00
Alvaro Muñoz	0cacb6feaf	Bump qlpack versions	2024-10-22 22:42:51 +02:00
Alvaro Muñoz	42d4bb577c	Better identification of checkout of untrusted code depending on the triggering events	2024-10-22 22:42:11 +02:00
Alvaro Muñoz	02c5f74f20	New gh CLI sources	2024-10-22 14:57:59 +02:00
Alvaro Muñoz	54338f4f35	Bump qlpack versions	2024-10-22 11:19:48 +02:00
Alvaro Muñoz	da10ee74d3	Add workflow_dispatch and scheduled to the list of privileged and external (user interaction) events	2024-10-22 11:18:42 +02:00
Kylie Stradley	023e8cbe3e	factor semver to separate function	2024-10-21 20:59:42 -04:00
Alvaro Muñoz	6dbbfa9672	Bump qlpack versions	2024-10-21 12:12:37 +02:00
Alvaro Muñoz	229d42b515	Add sonar-scanner-action as a poisonable step	2024-10-21 11:05:06 +02:00
Alvaro Muñoz	fc5a6703b3	Add github.event.sender.login as an Actor source	2024-10-19 17:01:47 +02:00
Alvaro Muñoz	e03ba55812	Account for checkout path on Untrusted Checkout Critical	2024-10-19 17:01:29 +02:00
Kylie Stradley	2d5cd1a61a	WIP. todo: modify help text in query to be helpful, write qlhelp file, find out how to not release to customers	2024-10-18 16:51:31 -04:00
Kylie Stradley	cf9b853a8f	unversioned immutable actions wip	2024-10-17 16:14:03 -04:00
Alvaro Muñoz	7cba2e07bc	Bump qlpack versions	2024-10-17 21:40:40 +02:00
Alvaro Muñoz	8323819504	New sources for octokit/request-action	2024-10-17 15:51:00 +02:00
Alvaro Muñoz	a1047d155c	Add new control checks using octokit/request-action	2024-10-17 14:48:53 +02:00
Alvaro Muñoz	6bf3eb79a9	Add sh as a bash-compatible POSIX shell	2024-10-17 10:44:43 +02:00
Alvaro Muñoz	b072cfa1f7	Add pwsh as the default shell for windows runners	2024-10-17 10:40:33 +02:00
Alvaro Muñoz	09f1fd1a81	Bump qlpack versions	2024-10-16 11:48:19 +02:00
Alvaro Muñoz	c5c3cd1726	Clean imports	2024-10-16 11:47:35 +02:00
Alvaro Muñoz	b49cd3b916	Better handling of EnvVar Injection and Argument Injection	2024-10-16 08:48:32 +02:00
Alvaro Muñoz	e2e1dddb36	Move arg injection sinks to ShellScript class	2024-10-15 09:48:01 +02:00
Alvaro Muñoz	3b95ae0b53	Bump QLPacks versions	2024-10-14 12:15:58 +02:00
Alvaro Muñoz	be87eccbe7	Refactor Script support	2024-10-14 12:04:20 +02:00
Alvaro Muñoz	a09acb5462	Better parsing of Bash script commands	2024-10-13 11:56:09 +02:00
Alvaro Muñoz	c7b57b5b77	Merge command and file store steps	2024-10-13 11:55:41 +02:00
Alvaro Muñoz	48fa2967ed	Bump qlpack versions	2024-10-11 12:22:40 +02:00
Alvaro Muñoz	1e749ae6d5	Add new poisonable step	2024-10-11 12:20:39 +02:00
Alvaro Muñoz	ee25f35653	Refactor of Bash functions	2024-10-11 12:20:26 +02:00
Alvaro Muñoz	d558ff80c3	New Command sources for git and GITHUB_EVENT_PATH	2024-10-11 12:20:03 +02:00
Alvaro Muñoz	d4a24dfdd1	Refactor FlowSteps	2024-10-11 12:19:22 +02:00
Alvaro Muñoz	6a99845ecf	Remove old code to handle redirections to GITHUB_ENV ... Redirections to GITHUB_ENV are better handled now by the Bash module ----	2024-10-10 22:22:56 +02:00
Alvaro Muñoz	b7aba1f081	Bump qlpack versions	2024-10-04 18:05:58 +02:00
Alvaro Muñoz	860eda9c04	Improve control checks to better account for toctou issues	2024-10-04 18:04:13 +02:00
Alvaro Muñoz	a3cf8766ff	Bump qlpack versions	2024-10-03 14:42:23 +02:00
Alvaro Muñoz	350b354fb3	remmove leftover comments	2024-10-03 14:17:45 +02:00