Aditya Sharad
956b5bf6d6
Actions: Fix typos in query names for env var injection
...
This will reflect in the UI titles of existing and new alerts
once shipped but should not churn any existing alerts.
2025-03-13 17:02:04 -07:00
Andrew Eisenberg
02051ff7b1
Update the security experimental suite
2025-03-12 11:46:03 -07:00
Andrew Eisenberg
cd63e7cf54
Fix the actions-security-and-quality.qls suite
...
It was not using the proper selectors. It is now the same as
other quality suites in other languages.
2025-03-12 11:43:59 -07:00
Arthur Baars
b2e0eaf664
Merge pull request #18965 from JarLob/docs
...
Minor example workflow fix
2025-03-12 11:17:42 +01:00
Remco Vermeulen
8f603251d7
Add missing dependency
...
The query pack has suites that rely on the `codeql/suite-helpers` pack, but doesn't include it as a dependency.
This will cause error when resolving suites referring the Actions query pack.
2025-03-10 18:31:01 -07:00
Jaroslav Lobačevski
fa35d6c3ac
Minor example workflow fix
2025-03-10 20:43:16 +00:00
Andrew Eisenberg
2a0e133768
Move UnversionedImmutableAction.ql to experimental
...
This query will give too many false positives for users until
immutable actions is released.
2025-03-06 15:08:02 -08:00
Chris Smowton
ee08e8b1fb
Merge pull request #18888 from github/dbartol/actions-executable-bit
...
Set the executable bit on the scripts in the Actions extractor
2025-03-03 08:53:50 +00:00
Dave Bartolomeo
ac555ff0a3
Set the executable bit on the scripts in the Actions extractor
2025-02-27 20:06:14 +00:00
Dave Bartolomeo
2dde9ab6b9
Move immutable-actions-list pack to codeql org
2025-02-27 12:30:11 -05:00
Dave Bartolomeo
abc174858e
Remove octokit as trusted Actions owner
2025-02-27 12:15:40 -05:00
Dave Bartolomeo
160346f51b
Add warnOnImplicitThis: true
2025-02-27 12:05:00 -05:00
Dave Bartolomeo
4e47da463e
Add change note
2025-02-27 12:04:09 -05:00
Dave Bartolomeo
86c5d9f1cd
Move list of immutable actions into internal model pack for now.
2025-02-27 11:48:27 -05:00
Chris Smowton
4567e02b8c
Regularise extractor pack licenses to all cite the MIT license that covers the whole CodeQL repository
2025-02-20 18:55:55 +00:00
github-actions[bot]
ad24f94a77
Post-release preparation for codeql-cli-2.20.5
2025-02-17 17:58:24 +00:00
github-actions[bot]
6f4562f3bd
Release preparation for version 2.20.5
2025-02-17 16:55:54 +00:00
martincostello
31913c4a55
Fix test
...
Fix failing test.
2025-02-14 19:46:46 +00:00
martincostello
f1723321fa
Format Document
...
Fix lint warning.
2025-02-14 18:06:00 +00:00
Martin Costello
979d604bf6
Apply suggestions from code review
...
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com >
2025-02-14 17:21:24 +00:00
martincostello
5d2409e652
Fix query
...
Forgot to move the `and`.
2025-02-14 13:36:09 +00:00
martincostello
9a7ed7f3f7
Re-order conditions
...
Makes for a neater diff.
2025-02-14 13:35:20 +00:00
martincostello
99bb0f0b4f
Use if then else
...
Apply code review suggestion.
Co-Authored-By: Taus <1104778+tausbn@users.noreply.github.com >
2025-02-14 13:30:55 +00:00
martincostello
cf8abb7989
Add change note
...
Add change note.
2025-02-14 13:27:36 +00:00
martincostello
71bc89beda
Fix query
...
Fix various issues with the query.
2025-02-14 12:59:02 +00:00
Martin Costello
9a29cebe58
Fix docker SHA false positive
...
Fix false positives for pinned Docker container images.
2025-02-14 12:35:55 +00:00
Dave Bartolomeo
0b2e307f9a
Merge pull request #18705 from github/dbartol/actions-suite-selectors
...
Use default query selectors for Actions suites
2025-02-07 14:06:00 -05:00
Dave Bartolomeo
0e4725bfe2
Merge pull request #18435 from felickz/felickz/actions-trusted-owner-data-extensions
...
Convert trusted actions list to data extension
2025-02-07 10:25:41 -05:00
Dave Bartolomeo
3b02f4d7bc
Update change note
2025-02-07 10:09:31 -05:00
Dave Bartolomeo
42562b5187
Merge pull request #18704 from github/dbartol/actions-suites
...
Actions: Move experimental queries to `experimental` directory
2025-02-07 10:03:31 -05:00
Chad Bentz
fd404bcbcd
Update actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md
...
Co-authored-by: Dave Bartolomeo <dbartol@github.com >
2025-02-06 14:28:07 -05:00
Dave Bartolomeo
ca7bcc9714
Add change note
2025-02-06 11:50:59 -05:00
Dave Bartolomeo
cb7aeea516
Use standard query selectors for actions-code-scanning and actions-security-extended
2025-02-06 11:34:43 -05:00
Dave Bartolomeo
74619d49b3
Update precision and severity for unpinned-tag
...
This ensures that it will be in `security-extended`, but not the default suite.
2025-02-06 11:33:17 -05:00
Dave Bartolomeo
81ff4dd81c
Update severity for excessive-secrets-exposure
...
This ensures that it will remain in the default suite.
2025-02-06 11:32:32 -05:00
Dave Bartolomeo
d7259c17db
Add security tag for missing-actions-permissions
...
This ensures that it will remain in the default suite.
2025-02-06 11:31:36 -05:00
Dave Bartolomeo
909de5280c
Update severity and precision of a few injection queries
...
These will wind up in `security-extended`, when previously they were not in any of the standard suites.
2025-02-06 11:30:43 -05:00
Dave Bartolomeo
e2ab65ea3e
Update qlref paths
2025-02-06 11:20:19 -05:00
Dave Bartolomeo
604dbfd0d0
Actions: Move experimental to experimental directory
...
This is consistent with how other languages manage experimental queries. I've left the `experimental` tags in place.
2025-02-06 10:54:25 -05:00
Asger F
83ccdb76ed
Merge pull request #18686 from asgerf/ac/bash-quotation-oom
...
Actions: avoid N^2 parsing in common cases
2025-02-06 09:59:23 +01:00
Asger F
4ec84e9327
Actions: update expected output
2025-02-05 13:36:38 +01:00
Asger F
1904b026b2
Actions: Avoid blowup in quotation parser
...
The parser has an inherent N^2 blowup and will need a rewrite eventually. For now I'm just trying to make it not blow up as often.
2025-02-05 13:35:52 +01:00
Asger F
e6b5040909
Actions: add test with many quoted strings
2025-02-05 13:35:50 +01:00
Remco Vermeulen
9894e9ef9f
Add CCR suites
2025-02-05 01:58:34 +00:00
github-actions[bot]
f1b05a79a4
Post-release preparation for codeql-cli-2.20.4
2025-02-04 09:25:09 +00:00
github-actions[bot]
573e53e454
Release preparation for version 2.20.4
2025-02-03 15:19:35 +00:00
Asger F
16634e6dc9
Merge pull request #18540 from JarLob/bash
...
Actions: Improve bash support
2025-01-28 09:49:58 +01:00
Jaroslav Lobačevski
9521467a06
Update actions/ql/lib/codeql/actions/Bash.qll
...
Co-authored-by: Asger F <asgerf@github.com >
2025-01-24 12:59:41 +01:00
Simon Friis Vindum
a6cd53eeb8
Merge pull request #18497 from paldepind/shared-basic-block-library
...
Add shared basic block library
2025-01-24 10:49:33 +01:00
Rasmus Wriedt Larsen
bafed4e098
Merge pull request #18560 from JarLob/downloadartifact
...
Actions: Fix version range for known vulnerable actions
2025-01-24 10:39:53 +01:00
