René's URL Explorer Experiment

Title: Make actions/unpinned-tag lockfile- and $/-aware by nodeselector · Pull Request #22155 · github/codeql · GitHub

Open Graph Title: Make actions/unpinned-tag lockfile- and $/-aware by nodeselector · Pull Request #22155 · github/codeql

X Title: Make actions/unpinned-tag lockfile- and $/-aware by nodeselector · Pull Request #22155 · github/codeql

Description: Overview Makes the actions/unpinned-tag query (CWE-829) aware of two cases where a mutable uses: tag is actually safe, so it stops reporting them: $/ self repository references — uses: $/path/to/action targets an action in the same repository at the running commit, so it is inherently pinned (like ./ self-workspace references). Lockfile-pinned references — a uses: recorded as pinned by the repository's Actions lockfile (.github/workflows/actions.lock) resolves to an immutable commit at runtime, so the mutable tag written in the workflow is not a real risk. How lockfile-awareness works The query gains a single seam predicate: pinnedByLockfile(uses, nwo, version) :- pinnedByLockfileDataModel(uses.getLocation().getFile().getRelativePath(), nwo, version) pinnedByLockfileDataModel(workflow_path, nwo, ref) is a new extensible predicate, defaulting to empty (ext/config/pinned_by_lockfile.yml ships data: []), so behaviour is unchanged unless something populates it. The extractor generates a database-local model pack .github/workflows/actions.lock records the resolved ref for each uses: (e.g. v1.2.0), but workflows usually write a shorter mutable tag (@v1). The query matches the ref as written, so a naïve resolved == written comparison would never match. This PR adds a small Go generator (actions/extractor/tools/lockfile-extension-generator/) that: parses the minimal, stable core of the lockfile format directly — it depends only on gopkg.in/yaml.v3 and builds anywhere the Go toolchain is available (no external/private dependency), normalizes each resolved ref into its variants — v1.2.0 also emits v1.2 and v1 — so a workflow pinned via @v1 is matched, renders a pinnedByLockfileDataModel data-extension YAML. The Actions extractor's autobuild.sh runs the generator during database create and atomically writes a self-contained model pack (codeql/actions-lockfile-pins) into /lockfile-extension/. Generation is staged in a temp dir and published with a single rename only on success (EXIT-trap cleanup otherwise), so a failed build never leaves a half-written pack. Repositories without a lockfile are a clean no-op, and a missing Go toolchain / build failure degrades gracefully without aborting extraction. The generator ships as packaged extractor source via the existing codeql_pkg_files(exes = glob(["tools/**"])) rule — no bazel go_binary target is needed. Applying it at analysis time CodeQL has no mechanism to auto-apply extensions carried inside a database (confirmed: extensions load only from --model-packs, --additional-packs, or as a static query-pack dependency). Because the data is per-repository and generated at extraction time, it cannot be a static dependency, so suppression takes effect only when the generated pack is supplied to analysis: codeql database analyze \ --additional-packs /lockfile-extension \ --model-packs codeql/actions-lockfile-pins \ actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql This mirrors the established codeql/immutable-actions-list pattern in this repo: a separate model pack applied via --model-packs by GitHub's internal analysis harness, not wired into the query pack. Adding the two flags above to that harness (out of this repo, same boundary immutable-actions-list already lives at) is the final step to make suppression apply during real code scanning. A native dbscheme relation was considered and rejected — it would require touching the shared JavaScript dbscheme and diverges from the model-pack pattern GitHub deliberately uses for this class of data. Testing Query tests (actions/ql/test/query-tests/Security/CWE-829, all 8 pass locally, CodeQL 2.26.0): self_ref_dollar.yml — both $/ forms produce no findings. lockfile_pinned.yml + pinned_by_lockfile.model.yml — some-owner/pinned-action@v1 is suppressed via a test data-extension; confirms the dataExtensions glob in test/qlpack.yml loads the .model.yml. UntrustedCheckoutCritical.expected gains one benign step-adjacency edge from the new two-uses: fixture (not a security finding). Generator has golden + unit tests (generator_test.go, lockfile_test.go) covering pin parsing, semver normalization, lockfile parsing, and byte-exact rendered output. Real end-to-end via the actual Actions extractor (codeql database create on a synthetic repo whose workflow writes some-owner/pinned-action@v1 while the lockfile resolves v1.2.0), with the generator built on demand by a stock Go toolchain: baseline analysis (no pack) reports both some-owner/pinned-action@v1 and an unlocked other-owner/unpinned@v2; analysis with the extractor-generated pack reports only other-owner/unpinned@v2 — the lockfile-pinned ref is suppressed through the full @v1 → v1.2.0 normalization path. Atomic generation verified across three cases: lockfile present (atomic publish), absent (clean no-op), no Go toolchain (graceful skip, no partial pack). Limitations Composite actions: the lockfile keys pins transitively under the workflow path, so a uses: appearing only inside a composite action.yml is not emitted against that file's path and won't be suppressed. This is a completeness gap only — a row is emitted solely for (path, nwo, ref) the lockfile actually pins, so it can never wrongly suppress a reference. Lockfile format coupling: the generator parses a minimal core of the lockfile format (lockfile.go) mirroring the canonical github.com/github/actions-lockfile semantics; if that format evolves, update lockfile.go and the golden fixture together. Files actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql — not isSelfRepository(...) + not pinnedByLockfile(...). actions/ql/lib/codeql/actions/config/{Config,ConfigExtensions}.qll — declare/re-export pinnedByLockfileDataModel. actions/ql/lib/ext/config/pinned_by_lockfile.yml — empty default extension. actions/extractor/tools/lockfile-extension-generator/** — dependency-free Go generator + tests + fixtures + README. actions/extractor/tools/generate-lockfile-extension.sh, autobuild.sh — extractor integration (atomic). Change notes under actions/ql/lib/change-notes/ and actions/ql/src/change-notes/.

Open Graph Description: Overview Makes the actions/unpinned-tag query (CWE-829) aware of two cases where a mutable uses: tag is actually safe, so it stops reporting them: $/ self repository references — uses: $/path/to/a...

X Description: Overview Makes the actions/unpinned-tag query (CWE-829) aware of two cases where a mutable uses: tag is actually safe, so it stops reporting them: $/ self repository references — uses: $/path/to/a...

Opengraph URL: https://github.com/github/codeql/pull/22155

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width