hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-13 05:31:22 +01:00
Code Issues Packages Projects Releases Wiki Activity
80,068 Commits 1,688 Branches 160 Tags
c19085e56e6830c190efd307c271f44851ed06df
Commit Graph

90 Commits

Author SHA1 Message Date
Nora Dimitrijević
f2bd454e99 Actions: mass enable diff-informed data flow 
An auto-generated patch that enables diff-informed data flow in the obvious cases.

Builds on https://github.com/github/codeql/pull/18346 and https://github.com/github/codeql-patch/pull/88
 2025-06-11 19:10:11 +02:00
Aditya Sharad
d659d40d58 Merge pull request #19701 from adityasharad/actions/bash-parsing-ranking-performance 
Actions: Improve Bash parsing performance on command and string interpolations
 2025-06-11 00:59:19 +05:30
github-actions[bot]
21463a9653 Post-release preparation for codeql-cli-2.22.0 2025-06-09 18:50:20 +00:00
github-actions[bot]
88ba02edf8 Release preparation for version 2.22.0 2025-06-09 18:14:51 +00:00
Aditya Sharad
e48a7da827 Actions: Add change note for Bash parsing fixes 2025-06-09 09:56:41 -07:00
Aditya Sharad
848064e95a Actions: Order quoted strings by their ID, not text 
In the Bash parser, we compute a mostly-unique ID for each
quoted string within a shell script block.
Quoted strings are then ranked and referred to individually.

Avoid a performance bottleneck by ranking quoted strings by their
ID, not by their source text.
I think this was the original intent of the code.

Ranking by their original text ends up evaluating multiple
possible orderings, which is slow on workflows that contain
multiple complex quoted strings, such as JSON payloads.
 2025-06-09 09:15:45 -07:00
Aditya Sharad
fbe11cfca6 Actions: Refactor logic for identifying quoted strings 
Add some doc comments and meaningful variable names.
 2025-06-09 09:15:45 -07:00
Aditya Sharad
321513c89b Actions: Order command substitutions by their ID, not text 
In the Bash parser, we compute a mostly-unique ID for each
command substitution within a shell script block.
Commands are then ranked and referred to individually.

Avoid a performance bottleneck by ranking commands by their
ID, not by their source text.
I think this was the original intent of the code.
Ranking by their original text ends up evaluating multiple
possible orderings, which is slow on workflows that contain
multiple complex command substitutions.
 2025-06-09 08:39:58 -07:00
Aditya Sharad
39e710e805 Actions: Refactor logic for identifying command substitution 
Extract helper predicates for `$(...)` command interpolation
and backtick-quoted commands.
Add some doc comments and meaningful variable names.
 2025-06-09 08:37:40 -07:00
Chuan-kai Lin
631502e129 Merge branch 'main' into cklin/rc-3.18-mergeback 2025-06-09 07:19:40 -07:00
Chris Smowton
338d3834c4 Actions: Make Env non-abstract 
`class Env` was previously abstract with no concrete descendants, so user queries like `any(Env e | ...)` would never produce results.

In the JS library the corresponding class derived from `YamlNode` and has concrete descendants representing workflow-, job- and step-level `env` nodes. However these are dubiously useful since you can always just use `any(Step s).getEnv()` to achieve the same result. Since `EnvImpl` already fully characterises an `env` node, I simply make the class concrete.
 2025-06-05 10:21:24 +01:00
github-actions[bot]
d2c6875eac Post-release preparation for codeql-cli-2.21.4 2025-05-27 18:16:21 +00:00
github-actions[bot]
bfb91e95e3 Release preparation for version 2.21.4 2025-05-27 17:22:05 +00:00
yoff
909c1bbcd9 Merge pull request #19494 from neilmendum/actions/more-minimal-permission 
actions: add some missing permissions
 2025-05-23 12:42:10 +02:00
Neil Mendum
1a1c9b4ea4 actions: add some missing permissions 2025-05-14 17:28:54 +01:00
github-actions[bot]
5f9dd75d7d Post-release preparation for codeql-cli-2.21.3 2025-05-13 21:49:43 +00:00
github-actions[bot]
2de4a01c86 Release preparation for version 2.21.3 2025-05-13 21:14:27 +00:00
Nick Rolfe
817237ce54 Merge pull request #19441 from github/nickrolfe/mergeback-2.21.2 
Merge back 2.21.2 release branch
 2025-05-01 11:55:29 +01:00
Aditya Sharad
6285c2e502 Actions: Retroactively add GA changenote 
This was manually added in the docs site at the time of 2.21.1 release and GA.
Include the change note in the relevant places so it remains
in future docs updates:
- codeql/actions-queries@0.5.4
- codeql/actions-all@0.4.7
- 2.21.1 changelog
 2025-04-30 16:24:22 -07:00
github-actions[bot]
2e0699ab2b Post-release preparation for codeql-cli-2.21.2 2025-04-28 14:03:28 +00:00
github-actions[bot]
625354c46e Release preparation for version 2.21.2 2025-04-28 10:55:22 +00:00
github-actions[bot]
d78736b1bf Post-release preparation for codeql-cli-2.21.1 2025-04-15 16:33:15 +00:00
github-actions[bot]
b961c5961d Release preparation for version 2.21.1 2025-04-14 09:53:06 +00:00
Aditya Sharad
d31896bf52 Merge pull request #19166 from yoff/actions/add-actions-permissions-MaD-model 
actions: add MaD model for permissions needed by actions
 2025-04-03 01:24:04 +05:30
yoff
7bf4a47549 Apply suggestions from code review 
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
 2025-04-02 08:43:29 +02:00
yoff
d83f35ff64 actions: remove unneded API 2025-04-01 17:07:43 +02:00
yoff
ee1eb199b5 actions: add description of actionsPermissionsDataModel 2025-04-01 17:07:02 +02:00
github-actions[bot]
10205cb990 Post-release preparation for codeql-cli-2.21.0 2025-04-01 11:30:43 +00:00
github-actions[bot]
84f6564cc0 Release preparation for version 2.21.0 2025-03-31 17:35:15 +00:00
Arthur Baars
bcd038c291 Actions: rename changenote file 2025-03-31 18:14:44 +02:00
yoff
e7bb47f335 ruby: add MaD model for permissions needed by actions 
Use this to suggest minimal set of nedded permissions
 2025-03-31 16:48:37 +02:00
Aditya Sharad
fe7660f396 Merge pull request #19085 from JarLob/nonpriv 
Fix potentially privileged pull request medium query
 2025-03-25 20:25:31 +05:30
Jaroslav Lobačevski
fe7d9eeb23 Update actions/ql/lib/change-notes/2025-03-20.md 
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
 2025-03-20 22:01:11 +01:00
Jaroslav Lobačevski
b85d4b590d move the change note to the correct directory 2025-03-20 20:29:35 +00:00
Jaroslav Lobačevski
5f63fc2048 Fix potentially privileged pull request medium query 2025-03-20 20:23:07 +00:00
github-actions[bot]
51cdeefafb Post-release preparation for codeql-cli-2.20.7 2025-03-17 13:00:41 +00:00
github-actions[bot]
2d64a618e6 Release preparation for version 2.20.7 2025-03-17 12:15:54 +00:00
github-actions[bot]
58f355ae5a Post-release preparation for codeql-cli-2.20.6 2025-03-03 18:18:15 +00:00
github-actions[bot]
fa850cccb1 Release preparation for version 2.20.6 2025-03-03 17:13:19 +00:00
Dave Bartolomeo
2dde9ab6b9 Move immutable-actions-list pack to codeql org 2025-02-27 12:30:11 -05:00
Dave Bartolomeo
abc174858e Remove octokit as trusted Actions owner 2025-02-27 12:15:40 -05:00
Dave Bartolomeo
86c5d9f1cd Move list of immutable actions into internal model pack for now. 2025-02-27 11:48:27 -05:00
github-actions[bot]
ad24f94a77 Post-release preparation for codeql-cli-2.20.5 2025-02-17 17:58:24 +00:00
github-actions[bot]
6f4562f3bd Release preparation for version 2.20.5 2025-02-17 16:55:54 +00:00
Dave Bartolomeo
0e4725bfe2 Merge pull request #18435 from felickz/felickz/actions-trusted-owner-data-extensions 
Convert trusted actions list to data extension
 2025-02-07 10:25:41 -05:00
Chad Bentz
fd404bcbcd Update actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md 
Co-authored-by: Dave Bartolomeo <dbartol@github.com>
 2025-02-06 14:28:07 -05:00
Asger F
1904b026b2 Actions: Avoid blowup in quotation parser 
The parser has an inherent N^2 blowup and will need a rewrite eventually. For now I'm just trying to make it not blow up as often.
 2025-02-05 13:35:52 +01:00
github-actions[bot]
f1b05a79a4 Post-release preparation for codeql-cli-2.20.4 2025-02-04 09:25:09 +00:00
github-actions[bot]
573e53e454 Release preparation for version 2.20.4 2025-02-03 15:19:35 +00:00
Asger F
16634e6dc9 Merge pull request #18540 from JarLob/bash 
Actions: Improve bash support
 2025-01-28 09:49:58 +01:00