Actions: report floating tags of immutable Actions in actions/unpinned-tag - #22630
Open
Darkslayer3324j wants to merge 1 commit into
Open
Darkslayer3324j wants to merge 1 commit into
Darkslayer3324j wants to merge 1 commit into
Conversation
…d-tag The query exempted any Action on the immutable-actions list regardless of the ref used. Only complete version tags (vX.Y.Z) and commit SHAs are immutable; floating tags such as v4, v4.1 or main are moved by the maintainers. Only exempt an immutable Action when it is pinned to a complete SemVer version. Fixes github#22414 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #22414.
actions/unpinned-tagexempted every Action on the immutable-actions list from the unpinned-tag warning, whatever ref it used. GitHub's immutability only covers complete release tags (vX.Y.Z) and commit SHAs; floating tags such asv4,v4.1,mainorlatestare moved by the maintainers and stay mutable.UnversionedImmutableActiondoes not catch these either, because itsisSemVeraccepts bare majors likev4.Change
UseOfUnversionedImmutableAction.qll: addisFullSemVer(completeX.Y.Z, optionalvprefix, pre-release and build metadata) and haveisSemVerreuse it, so the existing regex is not duplicated andUnversionedImmutableActionis unchanged.UnpinnedActionsTag.ql: the immutable-Action exemption now also requiresisFullSemVer(version). Full commit SHAs and lockfile pins were already handled by the earlier conditions; trusted-owner exemptions are untouched.minorAnalysis).As noted on the issue,
actionsandgithubare trusted by default, so the gap only shows without extra config foroctokit/request-action. It is also visible for any immutable Action once its owner is distrusted with a!ownerentry (#22415), which is why the new cases are in theCWE-829-untrusted-ownertest.Tests
CWE-829-untrusted-owner/.github/workflows/unpinned_immutable.ymlwith inline# $ Alertexpectations: floating tags (v4,v4.1,main,latest, andoctokit/request-action@v2,@v2.x) are reported;v4.2.2,4.2.2,v4.2.2-rc.1,octokit/request-action@v2.1.9and a full SHA are not. Without the query change, all six alerts show up asMissing result: Alert; with it the test passes.CWE-829/UnpinnedActionsTag.expectedgains 4 alerts, all the existingoctokit/request-action@v2.x/@v2.x.xuses (regenerated withcodeql test run --learn).codeql test runoverCWE-829,CWE-829-LockfileandCWE-829-untrusted-owner: 10/10 pass, includingUnversionedImmutableAction.codeql query format --check-onlyis clean on both changed QL files.Written with AI assistance (Claude Code); I reproduced the gap, ran the tests before and after, and checked the alert diffs above.