Paolo Tranquilli 4b8cb3ffac Fix false negative for branching nested reusable workflows ...

The previous fix required all outermost callers of a reusable workflow to
be protected, which collapsed distinct safe/unsafe inner paths that share
the same outermost caller. Track protection per caller chain instead: a
node inside a reusable workflow is only considered protected if there is
no unprotected caller path up to an outer workflow.

Adds a branching nested regression test where one inner job is protected
by a permission check and a sibling inner job is not.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-24 18:22:01 +02:00

..

extractor

Merge branch 'main' into henrymercer/actions-status

2025-09-05 14:55:58 +01:00

ql

Fix false negative for branching nested reusable workflows

2026-06-24 18:22:01 +02:00

BUILD.bazel

Bazel: add experimental to codeql_pack

2024-11-19 12:48:36 +01:00