FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Support distrusting Actions owners via `!owner` entries · github/codeql@bdf8710 · GitHub

  1. github
  2. codeql

Repository navigation

Commit bdf8710

Browse files
redsun82
and
Copilot
committed
Support distrusting Actions owners via !owner entries
Lets `trustedActionsOwnerDataModel` remove an owner (including the first-party `actions`, `github` and `advanced-security`) with a `!`-prefixed entry, so unpinned tags for those Actions are reported by `actions/unpinned-tag`. Unambiguous because owner names can never start with `!`. Closes #22409 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
1 parent 782f1fc commit bdf8710

7 files changed

Lines changed: 55 additions & 1 deletion

File tree

‎actions/ql/lib/change-notes/2026-08-24-untrusted-actions-owner.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `trustedActionsOwnerDataModel` extensible predicate, used by the `actions/unpinned-tag` query, now supports removing an owner from the trusted set by adding an entry prefixed with `!` (for example, `!github`). This makes it possible to distrust first-party owners (`actions`, `github`, `advanced-security`) so that unpinned tags for their Actions are reported.

‎actions/ql/lib/codeql/actions/config/Config.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,16 @@ predicate immutableActionsDataModel(string action) { Extensions::immutableAction
130130
* MaD models for trusted actions owners
131131
* Fields:
132132
* - owner: owner name
133+
*
134+
* An entry may be prefixed with `!` to remove an owner from the trusted set,
135+
* overriding any plain entry for the same owner (for example, `!github` distrusts
136+
* the first-party `github` owner). This is unambiguous because GitHub owner names
137+
* can never start with `!`.
133138
*/
134139
predicate trustedActionsOwnerDataModel(string owner) {
135-
Extensions::trustedActionsOwnerDataModel(owner)
140+
Extensions::trustedActionsOwnerDataModel(owner) and
141+
not owner.matches("!%") and
142+
not Extensions::trustedActionsOwnerDataModel("!" + owner)
136143
}
137144

138145
/**

‎actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/.github/workflows/unpinned_first_party.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Unpinned first-party actions
2+
on: push
3+
jobs:
4+
build:
5+
runs-on: ubuntu-latest
6+
steps:
7+
# `actions` is distrusted via `!actions`, and this action is not immutable,
8+
# so this unpinned tag is reported.
9+
- uses: actions/first-interaction@v1
10+
# `github` remains trusted, so this unpinned tag is not reported.
11+
- uses: github/issue-labeler@v3.0
12+
# Third-party owner is always reported.
13+
- uses: foo/bar@v1

‎actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| .github/workflows/unpinned_first_party.yml:9:15:9:42 | actions/first-interaction@v1 | Unpinned 3rd party Action 'Unpinned first-party actions' step $@ uses 'actions/first-interaction' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_first_party.yml:9:9:11:6 | Uses Step | Uses Step |
2+
| .github/workflows/unpinned_first_party.yml:13:15:13:24 | foo/bar@v1 | Unpinned 3rd party Action 'Unpinned first-party actions' step $@ uses 'foo/bar' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_first_party.yml:13:9:13:25 | Uses Step | Uses Step |

‎actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.ext.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/actions-all
4+
extensible: trustedActionsOwnerDataModel
5+
data:
6+
# Distrust the first-party `actions` owner so unpinned tags for its
7+
# Actions are reported. `github` is intentionally left trusted.
8+
- ["!actions"]

‎actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-829/UnpinnedActionsTag.ql

‎docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,3 +83,22 @@ To allow any Action from the publisher ``octodemo``, such as ``octodemo/3rd-part
8383
3. Ensure that the model pack is included in your CodeQL analysis.
8484

8585
By following these steps, you will add ``octodemo`` to the list of trusted Action publishers, and the query will no longer generate security alerts for unpinned tags from this publisher. For more information, see `Extending CodeQL coverage with CodeQL model packs in default setup <https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#extending-codeql-coverage-with-codeql-model-packs-in-default-setup>`_ and `Creating and working with CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack>`_.
86+
87+
Example: Remove a trusted Actions publisher for the ``actions/unpinned-tag`` query
88+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
89+
90+
GitHub's own organizations (``actions``, ``github`` and ``advanced-security``) are trusted by default. If you want unpinned tags for these first-party Actions to be reported as well, you can remove an owner from the trusted list by adding an entry prefixed with ``!``. A ``!`` entry always takes precedence over a plain entry for the same owner.
91+
92+
To distrust the first-party ``github`` owner, add a data extension file with the following content:
93+
94+
.. code-block:: yaml
95+
96+
extensions:
97+
- addsTo:
98+
pack: codeql/actions-all
99+
extensible: trustedActionsOwnerDataModel
100+
data:
101+
- ["!github"]
102+
103+
With this in place, the query will once again report unpinned tags for Actions published by ``github``.
104+

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL