False positive in CWE-829 /UntrustedCheckoutMedium.ql

[tstellar]

Description of the false positive
When there is a workflow that is triggered by a pull_request, this check considers the called workflow to be privileged even though it is not.

Code samples or links to source code

Triggered Workflow: https://raw.githubusercontent.com/llvm/llvm-project/refs/heads/main/.github/workflows/release-binaries-all.yml
Called Workflow: https://raw.githubusercontent.com/llvm/llvm-project/refs/heads/main/.github/workflows/release-binaries.yml

URL to the alert on GitHub code scanning (optional)

https://github.com/llvm/llvm-project/security/code-scanning/1828

[redsun82]

Thanks for the report 🙂

It turns out the query doesn't fully account for the fact that workflow_call invocations originating from pull_request triggers inherit the restricted permissions (read-only, no secrets for forks) that GitHub enforces. So yes, this is a genuine false positive in your case.

We'll track this internally. I should mention that false positive improvements are not a priority for our teams at the moment, so I can't commit to a timeline for a fix.