-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Make actions/unpinned-tag lockfile- and $/-aware #22155
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
nodeselector
wants to merge
22
commits into
github:main
Choose a base branch
from
nodeselector:nodeselector-actions-lockfile-aware-pinning
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
22 commits
Select commit
Hold shift + click to select a range
7fedff2
actions: stop unpinned-tag flagging $/ self-references
nodeselector 180c109
actions: scaffold lockfile-aware pinning for unpinned-tag
nodeselector e80ae35
actions: add lockfile-to-data-extension generator for unpinned-tag
nodeselector 9f8032d
actions: generate lockfile-pinned data extension during extraction
nodeselector 9e7133b
actions: drop machine-specific replace, document lockfile generator l…
nodeselector d425c27
actions: keep lockfile generator go.mod free of local replace
nodeselector feed864
actions: rename self-reference to self repository in unpinned-tag
nodeselector c17aea9
actions: make lockfile-extension generation atomic
nodeselector 287a59c
actions: drop private actions-lockfile dependency from generator
nodeselector b6a8394
actions: emit empty data list for zero-row lockfile extension
nodeselector f8f8aa8
actions/unpinned-tag: match lockfile pins case-insensitively on owner…
nodeselector 2db34d2
actions: use US spelling in lockfile-aware pinning comments
nodeselector 77ac6d9
actions: drop lockfile-extension generator from unpinned-tag PR
nodeselector 91faa26
actions/unpinned-tag: normalize lockfile action identity
nodeselector 45a6dd7
actions/unpinned-tag: regenerate expected results after sync
nodeselector 2e04003
Actions: consume extracted lockfile pins
nodeselector 24a18e4
Actions tests: add lockfile inline expectations
nodeselector e005d15
Actions tests: share inline expectations utility
nodeselector 38f59df
Actions tests: keep inline adapter outside library API
nodeselector 2b7e7ab
Actions lockfiles: ignore schema version value
nodeselector a2213ae
Actions lockfiles: match repository casing
nodeselector ff9bf5d
Code review suggestions
hvitved File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 4 additions & 0 deletions
4
actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * The `actions/unpinned-tag` query no longer reports action references pinned by a structurally valid `.github/workflows/actions.lock` entry for the enclosing workflow. |
4 changes: 4 additions & 0 deletions
4
actions/ql/src/change-notes/2026-07-09-unpinned-tag-self-repository.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * The `actions/unpinned-tag` query no longer reports `$/` self repository references (e.g. `uses: $/path/to/action`), which resolve to the same repository at the running commit and are therefore inherently pinned, just like `./` self workspace (local) references. |
30 changes: 30 additions & 0 deletions
30
actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/actions.lock
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| version: future-version | ||
| workflows: | ||
| .github/workflows/rust-ci.yml: | ||
| - DToLnAy/RuSt-ToOlChAiN@v1 | ||
| - mismatched/action@v1 | ||
| - malformed/action@v1 | ||
| - missing/action@v1 | ||
| .github/workflows/other.yml: | ||
| - other-workflow/action@v1 | ||
| dependencies: | ||
| DToLnAy/RuSt-ToOlChAiN@v1: | ||
| ref: v1 | ||
| commit: sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 | ||
| owner_id: 1940490 | ||
| repo_id: 260749683 | ||
| other-workflow/action@v1: | ||
| ref: v1 | ||
| commit: sha1-1111111111111111111111111111111111111111 | ||
| owner_id: 1 | ||
| repo_id: 2 | ||
| mismatched/action@v1: | ||
| ref: V1 | ||
| commit: sha1-2222222222222222222222222222222222222222 | ||
| owner_id: 3 | ||
| repo_id: 4 | ||
| malformed/action@v1: | ||
| ref: v1 | ||
| commit: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 | ||
| owner_id: 5 | ||
| repo_id: 6 |
16 changes: 16 additions & 0 deletions
16
actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/rust-ci.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| on: | ||
| pull_request | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: dtolnay/rust-toolchain@v1 | ||
| - uses: DToLnAy/RuSt-ToOlChAiN/save@v1 | ||
| - uses: dtolnay/rust-toolchain@V1 # $ Alert | ||
| - uses: other-workflow/action@v1 # $ Alert | ||
| - uses: mismatched/action@v1 # $ Alert | ||
| - uses: malformed/action@v1 # $ Alert | ||
| - uses: missing/action@v1 # $ Alert | ||
| reusable: | ||
| uses: dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 # $ Alert |
6 changes: 6 additions & 0 deletions
6
actions/ql/test/query-tests/Security/CWE-829-Lockfile/UnpinnedActionsTag.expected
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| | .github/workflows/rust-ci.yml:10:13:10:37 | dtolnay/rust-toolchain@V1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'dtolnay/rust-toolchain' with ref 'V1', not a pinned commit hash | .github/workflows/rust-ci.yml:10:7:11:4 | Uses Step | Uses Step | | ||
| | .github/workflows/rust-ci.yml:11:13:11:36 | other-workflow/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'other-workflow/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:11:7:12:4 | Uses Step | Uses Step | | ||
| | .github/workflows/rust-ci.yml:12:13:12:32 | mismatched/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'mismatched/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:12:7:13:4 | Uses Step | Uses Step | | ||
| | .github/workflows/rust-ci.yml:13:13:13:31 | malformed/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'malformed/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:13:7:14:4 | Uses Step | Uses Step | | ||
| | .github/workflows/rust-ci.yml:14:13:14:29 | missing/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:14:7:15:2 | Uses Step | Uses Step | | ||
| | .github/workflows/rust-ci.yml:16:11:16:66 | dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 | Job $@ in 'rust-ci.yml' uses reusable workflow 'dtolnay/rust-toolchain/.github/workflows/reusable.yml' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:16:5:16:77 | Job: reusable | Job: reusable | |
2 changes: 2 additions & 0 deletions
2
actions/ql/test/query-tests/Security/CWE-829-Lockfile/UnpinnedActionsTag.qlref
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| query: Security/CWE-829/UnpinnedActionsTag.ql | ||
| postprocess: utils/ActionsInlineExpectationsTestQuery.ql |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| semmle-extractor-options: --file-type YAML .github/workflows/actions.lock |
15 changes: 15 additions & 0 deletions
15
actions/ql/test/query-tests/Security/CWE-829/.github/workflows/self_ref_dollar.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| on: | ||
| pull_request | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Build and test | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| # `$/` is a same-repository (self repository) reference resolved at the running commit. It is | ||
| # inherently pinned (like `./` self workspace refs) and must never be reported as an unpinned tag. | ||
| - uses: $/actions/foo | ||
| # `$/…@ref` is rejected by the `$/` rule, but a user could still write it. It must also | ||
| # never be flagged; this case exercises the `not isSelfRepository(nwo)` suppression, since | ||
| # without it `$/actions/foo@v1` would otherwise be reported as an unpinned tag. | ||
| - uses: $/actions/foo@v1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
30 changes: 30 additions & 0 deletions
30
actions/ql/test/utils/ActionsInlineExpectationsTestQuery.ql
|
nodeselector marked this conversation as resolved.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| /** | ||
| * @kind test-postprocess | ||
| */ | ||
|
|
||
| private import codeql.Locations as Locations | ||
| private import codeql.actions.ast.internal.Yaml as Yaml | ||
| private import codeql.util.test.InlineExpectationsTest as T | ||
| import T::TestPostProcessing | ||
|
|
||
| private module Impl implements T::InlineExpectationsTestSig { | ||
| class Location = Locations::Location; | ||
|
|
||
| class ExpectationComment extends Yaml::YamlComment { | ||
| string getContents() { result = this.getText() } | ||
| } | ||
| } | ||
|
|
||
| private module Input implements T::TestPostProcessing::InputSig<Impl> { | ||
| string getRelativeUrl(Locations::Location location) { | ||
| exists(int startLine, int startColumn, int endLine, int endColumn | | ||
| location.hasLocationInfo(_, startLine, startColumn, endLine, endColumn) | ||
| | | ||
| result = | ||
| location.getFile().getRelativePath() + ":" + startLine + ":" + startColumn + ":" + endLine + | ||
| ":" + endColumn | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| import T::TestPostProcessing::Make<Impl, Input> |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because of this change,
actions/ql/test/library-tests/actions-lock/actions.lockneeds to be moved intoactions/ql/test/library-tests/actions-lock/.github/workflows/actions.lock, andactions/ql/test/library-tests/actions-lock/test.expectedneeds to be updated accordingly.