Paolo Tranquilli 4b8cb3ffac Fix false negative for branching nested reusable workflows ...

The previous fix required all outermost callers of a reusable workflow to
be protected, which collapsed distinct safe/unsafe inner paths that share
the same outermost caller. Track protection per caller chain instead: a
node inside a reusable workflow is only considered protected if there is
no unprotected caller path up to an outer workflow.

Adds a branching nested regression test where one inner job is protected
by a permission check and a sibling inner job is not.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-24 18:22:01 +02:00

..

external/TestOrg/TestRepo/.github/workflows

Fix false negative for branching nested reusable workflows

2026-06-24 18:22:01 +02:00

actor_trusted_checkout.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning11.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning12.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning21.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning22.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning31.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning32.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning33.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning34.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning41.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning42.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning51.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning52.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning53.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning71.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning81.yml

Fix lower range for known vulnerable actions

2025-01-22 17:30:19 +01:00

artifactpoisoning82.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning91.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning92.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

artifactpoisoning93.yml

Add tests and path normalization fix to handle $ expansion

2025-07-08 16:18:12 +00:00

artifactpoisoning94.yml

Add tests and path normalization fix to handle $ expansion

2025-07-08 16:18:12 +00:00

artifactpoisoning95.yml

Add tests and path normalization fix to handle $ expansion

2025-07-08 16:18:12 +00:00

artifactpoisoning96.yml

Add tests and path normalization fix to handle $ expansion

2025-07-08 16:18:12 +00:00

artifactpoisoning97.yml

Add extra test suggested by @Napalys

2025-07-10 12:24:36 -04:00

artifactpoisoning101.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

auto_ci.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

dependabot1.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

dependabot2.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

dependabot3.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

formal.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

gitcheckout.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

issue_comment_3rd_party_action.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

issue_comment_direct.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

issue_comment_heuristic.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

issue_comment_octokit2.yml

Upgrade workflows to ubuntu-24

2025-01-17 11:22:15 +01:00

issue_comment_octokit.yml

Upgrade workflows to ubuntu-24

2025-01-17 11:22:15 +01:00

label_trusted_checkout1.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

label_trusted_checkout2.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

level0.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

mend.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

poc2.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

poc3.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

poc.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

pr-workflow-fork.yaml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

pr-workflow.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

priv_pull_request_checkout.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

resolve-args.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

reusable_caller1.yaml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

reusable_caller2.yaml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

reusable_caller3.yaml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

reusable_local.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test1.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test2.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test3.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test4.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test5.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test6.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test7.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test8.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test9.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test10.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test11.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test12.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test13.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test14.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test15.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test16.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test17.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test18.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test19.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test20.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test21.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test22.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test23.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test24.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test25.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test26.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test27.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test28.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test29.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

test.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

unpinned_tags.yml

Widen pinned SHA regex to support SHA-256 (64-char hex) and add tests

2026-05-12 22:40:03 +01:00

untrusted_checkout2.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

untrusted_checkout3.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

untrusted_checkout4.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

untrusted_checkout_5.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

untrusted_checkout_6.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

untrusted_checkout_no_needs.yml

Fix dominates() false positive in reusable workflows

2026-06-15 05:42:59 +00:00

untrusted_checkout_permission_check_reusable2.yml

Fix false negatives when one of the jobs had proper checks and the other didn't

2026-06-18 12:02:56 +00:00

untrusted_checkout_permission_check_reusable_branching_nested.yml

Fix false negative for branching nested reusable workflows

2026-06-24 18:22:01 +02:00

untrusted_checkout_permission_check_reusable_level2.yml

Support nested reusable workflows

2026-06-15 06:52:13 +00:00

untrusted_checkout_permission_check_reusable_no_needs.yml

Support nested reusable workflows

2026-06-15 06:52:13 +00:00

untrusted_checkout_permission_check_reusable.yml

Fix dominates() false positive in reusable workflows

2026-06-15 05:42:59 +00:00

untrusted_checkout_permissions_check.yml

Fix false negatives when one of the jobs had proper checks and the other didn't

2026-06-18 12:02:56 +00:00

untrusted_checkout_two_callers_both_protected.yml

Fix for independent checks

2026-06-23 11:52:11 +00:00

untrusted_checkout.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

workflow_run_untrusted_checkout_2.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

workflow_run_untrusted_checkout_3.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00

workflow_run_untrusted_checkout.yml

Move into actions subdirectory to prepare for migration to github/codeql

2024-12-18 14:35:15 -05:00