From 62e81cdaa24d554eae175ecd245d5030c56b42c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= Date: Fri, 17 Jul 2026 15:32:19 +0000 Subject: [PATCH 1/7] Support for the new model of external workflows and composite actions --- actions/extractor/tools/autobuild-impl.ps1 | 10 +- actions/extractor/tools/autobuild.sh | 10 +- actions/extractor/tools/baseline-config.json | 4 +- actions/ql/lib/codeql/actions/Helper.qll | 7 +- .../lib/codeql/actions/ast/internal/Ast.qll | 155 +++++++++++++++++- .../ql/lib/codeql/actions/config/Config.qll | 36 ++++ .../actions/config/ConfigExtensions.qll | 16 ++ .../dataflow/internal/DataFlowPrivate.qll | 2 +- .../actions/security/CodeInjectionQuery.qll | 2 +- .../lib/ext/config/workflow_runtime_data.yml | 8 + .../external-reusable-workflows.model.yml | 24 +++ .../.github/actions/leaf/action.yml | 7 + .../.github/actions/root-v1/action.yml | 6 + .../.github/actions/root-v2/action.yml | 6 + .../.github/workflows/caller.yml | 12 ++ .../remote/action.yml | 6 + .../remote/action.yml | 6 + .../remote/action.yml | 6 + .../external_composite_actions.expected | 6 + .../external_composite_actions.ql | 12 ++ .../workflows/external_reusable_workflow.yml | 10 ++ .../unmodeled_external_reusable_workflow.yml | 8 + .../.github/workflows/legacy.yml | 6 + .../.github/workflows/first.yml | 8 + .../.github/workflows/second.yml | 10 ++ .../.github/workflows/first.yml | 8 + .../.github/workflows/second.yml | 10 ++ .../external_reusable_workflows.expected | 4 + .../external_reusable_workflows.ql | 5 + actions/ql/test/qlpack.yml | 2 + .../.github/actions/clone-repo/action.yaml | 0 .../.github/workflows/publishResults.yml | 0 .../.github/workflows/reusable-workflow.yml | 0 .../action.yaml | 0 .../CWE-094/CodeInjectionCritical.expected | 84 +++++----- .../CWE-094/CodeInjectionMedium.expected | 68 ++++---- .../.github/workflows/build.yml | 0 .../.github/workflows/build_nested.yml | 0 .../workflows/build_nested_branching.yml | 0 .../.github/workflows/formal.yml | 0 .../.github/workflows/reusable.yml | 0 .../UntrustedCheckoutCritical.expected | 18 +- ...customizing-library-models-for-actions.rst | 2 + 43 files changed, 475 insertions(+), 109 deletions(-) create mode 100644 actions/ql/test/external-reusable-workflows.model.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ffffffffffffffffffffffffffffffffffffffff/remote/action.yml create mode 100644 actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected create mode 100644 actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/legacy.yml create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected create mode 100644 actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql rename actions/ql/test/query-tests/Security/CWE-094/{.github/actions/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111}/.github/actions/clone-repo/action.yaml (100%) rename actions/ql/test/query-tests/Security/CWE-094/{.github/workflows/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc}/.github/workflows/publishResults.yml (100%) rename actions/ql/test/query-tests/Security/CWE-094/{.github/workflows/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc}/.github/workflows/reusable-workflow.yml (100%) rename actions/ql/test/query-tests/Security/CWE-094/{.github/actions/external/ultralytics/actions => 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222}/action.yaml (100%) rename actions/ql/test/query-tests/Security/CWE-829/{.github/workflows/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc}/.github/workflows/build.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/{.github/workflows/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc}/.github/workflows/build_nested.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/{.github/workflows/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc}/.github/workflows/build_nested_branching.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/{.github/workflows/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc}/.github/workflows/formal.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/{.github/workflows/external/TestOrg/TestRepo => 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc}/.github/workflows/reusable.yml (100%) diff --git a/actions/extractor/tools/autobuild-impl.ps1 b/actions/extractor/tools/autobuild-impl.ps1 index e232cd3cc545..00e0bcda84fd 100644 --- a/actions/extractor/tools/autobuild-impl.ps1 +++ b/actions/extractor/tools/autobuild-impl.ps1 @@ -1,13 +1,11 @@ -# Note: We're adding the `reusable_workflows` subdirectories to proactively -# record workflows that were called cross-repo, check them out locally, -# and enable an interprocedural analysis across the workflow files. -# These workflows follow the convention `.github/reusable_workflows//*.ya?ml` +# Include downloaded external reusable workflows to enable interprocedural analysis. +# These workflows are stored below a generated UUID directory at the repository root. $DefaultPathFilters = @( 'exclude:**/*', 'include:.github/workflows/*.yml', 'include:.github/workflows/*.yaml', - 'include:.github/reusable_workflows/**/*.yml', - 'include:.github/reusable_workflows/**/*.yaml', + 'include:9466014afba34ef28239871ceabf4132/**/*.yml', + 'include:9466014afba34ef28239871ceabf4132/**/*.yaml', 'include:**/action.yml', 'include:**/action.yaml' ) diff --git a/actions/extractor/tools/autobuild.sh b/actions/extractor/tools/autobuild.sh index f2cbb7ddfa7e..eb2cbd45cffd 100755 --- a/actions/extractor/tools/autobuild.sh +++ b/actions/extractor/tools/autobuild.sh @@ -2,16 +2,14 @@ set -eu -# Note: We're adding the `reusable_workflows` subdirectories to proactively -# record workflows that were called cross-repo, check them out locally, -# and enable an interprocedural analysis across the workflow files. -# These workflows follow the convention `.github/reusable_workflows//*.ya?ml` +# Include downloaded external reusable workflows to enable interprocedural analysis. +# These workflows are stored below a generated UUID directory at the repository root. DEFAULT_PATH_FILTERS=$(cat << END exclude:**/* include:.github/workflows/*.yml include:.github/workflows/*.yaml -include:.github/reusable_workflows/**/*.yml -include:.github/reusable_workflows/**/*.yaml +include:9466014afba34ef28239871ceabf4132/**/*.yml +include:9466014afba34ef28239871ceabf4132/**/*.yaml include:**/action.yml include:**/action.yaml END diff --git a/actions/extractor/tools/baseline-config.json b/actions/extractor/tools/baseline-config.json index fde0bd1ecdff..1e1761803e8b 100644 --- a/actions/extractor/tools/baseline-config.json +++ b/actions/extractor/tools/baseline-config.json @@ -2,8 +2,8 @@ "paths": [ ".github/workflows/*.yml", ".github/workflows/*.yaml", - ".github/reusable_workflows/**/*.yml", - ".github/reusable_workflows/**/*.yaml", + "9466014afba34ef28239871ceabf4132/**/*.yml", + "9466014afba34ef28239871ceabf4132/**/*.yaml", "**/action.yml", "**/action.yaml" ] diff --git a/actions/ql/lib/codeql/actions/Helper.qll b/actions/ql/lib/codeql/actions/Helper.qll index 348ec75a5193..2291915b7a6b 100644 --- a/actions/ql/lib/codeql/actions/Helper.qll +++ b/actions/ql/lib/codeql/actions/Helper.qll @@ -48,14 +48,9 @@ string getRepoRoot() { w.getLocation() .getFile() .getRelativePath() - .prefix(w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") + 1) and - // exclude workflow_enum reusable workflows directory root - not result.indexOf(".github/workflows/external/") > -1 and - not result.indexOf(".github/actions/external/") > -1 + .prefix(w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") + 1) or not w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") > 0 and - not w.getLocation().getFile().getRelativePath().indexOf(".github/workflows/external/") > -1 and - not w.getLocation().getFile().getRelativePath().indexOf(".github/actions/external/") > -1 and result = "" ) } diff --git a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll index 82d4a1186708..6721a7ad1462 100644 --- a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll +++ b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll @@ -372,6 +372,14 @@ class ExpressionImpl extends AstNodeImpl, TExpressionNode { } } +bindingset[owner, repo, action_path] +private string externalCompositeActionName(string owner, string repo, string action_path) { + action_path.trim() = "" and result = owner.trim() + "/" + repo.trim() + or + not action_path.trim() = "" and + result = owner.trim() + "/" + repo.trim() + "/" + action_path.trim() +} + class CompositeActionImpl extends AstNodeImpl, TCompositeAction { YamlMapping n; @@ -415,7 +423,38 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction { ) } + predicate getAnExternalCompositeActionModel( + string owner, string repo, string action_path, string requested_ref, + string resolved_commit_sha, string local_path + ) { + externalCompositeActionDataModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) and + local_path.trim() = this.getLocation().getFile().getRelativePath() + } + + predicate isExternalCompositeAction() { + exists(string owner, string repo, string action_path, string requested_ref, + string resolved_commit_sha, string local_path | + this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) + ) + or + this.getLocation() + .getFile() + .getRelativePath() + .matches("9466014afba34ef28239871ceabf4132/%") + } + string getResolvedPath() { + exists(string owner, string repo, string action_path, string requested_ref, + string resolved_commit_sha, string local_path | + this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) and + result = + externalCompositeActionName(owner, repo, action_path) + "@" + requested_ref.trim() + ) + or + not this.isExternalCompositeAction() and result = ["", "./"] + this.getLocation() @@ -424,7 +463,6 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction { .replaceAll(getRepoRoot(), "") .replaceAll("/action.yml", "") .replaceAll("/action.yaml", "") - .replaceAll(".github/actions/external/", "") } private predicate hasExplicitSecretAccess() { @@ -542,14 +580,45 @@ class ReusableWorkflowImpl extends AstNodeImpl, WorkflowImpl { ) } + predicate getAnExternalReusableWorkflowModel( + string owner, string repo, string workflow_path, string requested_ref, + string resolved_commit_sha, string local_path + ) { + externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, + resolved_commit_sha, local_path) and + local_path.trim() = this.getLocation().getFile().getRelativePath() + } + + predicate isExternalReusableWorkflow() { + exists(string owner, string repo, string workflow_path, string requested_ref, + string resolved_commit_sha, string local_path | + this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, + resolved_commit_sha, local_path) + ) + or + this.getLocation() + .getFile() + .getRelativePath() + .matches("9466014afba34ef28239871ceabf4132/%") // root folder for external workflows and composite actions + } + string getResolvedPath() { + exists(string owner, string repo, string workflow_path, string requested_ref, + string resolved_commit_sha, string local_path | + this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, + resolved_commit_sha, local_path) and + result = + owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() + "@" + + requested_ref.trim() + ) + or + not this.isExternalReusableWorkflow() and result = ["", "./"] + this.getLocation() .getFile() .getRelativePath() .replaceAll(getRepoRoot(), "") - .replaceAll(".github/workflows/external/", "") } } @@ -1336,6 +1405,8 @@ class EnvImpl extends AstNodeImpl, TEnvNode { abstract class UsesImpl extends AstNodeImpl { abstract string getCallee(); + abstract string getCallableName(); + abstract ScalarValueImpl getCalleeNode(); abstract string getVersion(); @@ -1374,6 +1445,47 @@ class UsesStepImpl extends StepImpl, UsesImpl { else result = u.getValue() } + private predicate isLocalCall() { u.getValue().matches(["./%", ".github/%"]) } + + private predicate hasModeledExternalCallee() { + exists(string owner, string repo, string action_path, string requested_ref, + string resolved_commit_sha, string local_path | + externalCompositeActionDataModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) and + this.getCallee() = externalCompositeActionName(owner, repo, action_path) and + this.getVersion() = requested_ref.trim() + ) + } + + private predicate hasExternalEnclosingCompositeAction() { + exists(CompositeActionImpl action | + action = this.getEnclosingCompositeAction() and action.isExternalCompositeAction() + ) + } + + private predicate hasModeledExternalEnclosingCompositeAction() { + exists(CompositeActionImpl action, string owner, string repo, string action_path, + string requested_ref, string resolved_commit_sha, string local_path | + action = this.getEnclosingCompositeAction() and + action.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) + ) + } + + override string getCallableName() { + this.isLocalCall() and + ( + this.hasModeledExternalEnclosingCompositeAction() + or + not this.hasExternalEnclosingCompositeAction() + ) and + result = this.getCallee() + or + not this.isLocalCall() and + this.hasModeledExternalCallee() and + result = this.getCallee() + "@" + this.getVersion() + } + override ScalarValueImpl getCalleeNode() { result.getNode() = u } /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */ @@ -1409,6 +1521,45 @@ class ExternalJobImpl extends JobImpl, UsesImpl { u.getValue().regexpCapture(repoUsesParser(), 3) } + private predicate isLocalCall() { u.getValue().matches("./%") } + + private predicate hasExternalEnclosingWorkflow() { + exists(ReusableWorkflowImpl enclosing_workflow | + enclosing_workflow = this.getEnclosingWorkflow() and + enclosing_workflow.isExternalReusableWorkflow() + ) + } + + private predicate hasModeledExternalCallee() { + exists(string owner, string repo, string workflow_path, string requested_ref, + string resolved_commit_sha, string local_path | + externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, + resolved_commit_sha, local_path) and + this.getCallee() = owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() and + this.getVersion() = requested_ref.trim() + ) + } + + override string getCallableName() { + this.isLocalCall() and + exists(ReusableWorkflowImpl enclosing_workflow, string owner, string repo, string workflow_path, + string requested_ref, string resolved_commit_sha, string local_path | + enclosing_workflow = this.getEnclosingWorkflow() and + enclosing_workflow.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, + resolved_commit_sha, local_path) and + result = + owner.trim() + "/" + repo.trim() + "/" + this.getCallee() + "@" + requested_ref.trim() + ) + or + this.isLocalCall() and + not this.hasExternalEnclosingWorkflow() and + result = this.getCallee() + or + not this.isLocalCall() and + this.hasModeledExternalCallee() and + result = this.getCallee() + "@" + this.getVersion() + } + override ScalarValueImpl getCalleeNode() { result.getNode() = u } /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */ diff --git a/actions/ql/lib/codeql/actions/config/Config.qll b/actions/ql/lib/codeql/actions/config/Config.qll index e6359c142582..dd1c0073abb9 100644 --- a/actions/ql/lib/codeql/actions/config/Config.qll +++ b/actions/ql/lib/codeql/actions/config/Config.qll @@ -16,6 +16,42 @@ predicate workflowDataModel( Extensions::workflowDataModel(path, trigger, job, secrets_source, permissions, runner) } +/** + * MaD models for downloaded external reusable workflows + * Fields: + * - owner: Repository owner + * - repo: Repository name + * - workflow_path: Workflow path within the repository + * - requested_ref: Ref used by the caller + * - resolved_commit_sha: Commit to which the ref resolved + * - local_path: Downloaded workflow path within the analyzed repository + */ +predicate externalReusableWorkflowDataModel( + string owner, string repo, string workflow_path, string requested_ref, string resolved_commit_sha, + string local_path +) { + Extensions::externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, + resolved_commit_sha, local_path) +} + +/** + * MaD models for downloaded external composite actions + * Fields: + * - owner: Repository owner + * - repo: Repository name + * - action_path: Action path within the repository + * - requested_ref: Ref used by the caller + * - resolved_commit_sha: Commit to which the ref resolved + * - local_path: Downloaded action metadata path within the analyzed repository + */ +predicate externalCompositeActionDataModel( + string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha, + string local_path +) { + Extensions::externalCompositeActionDataModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) +} + /** * MaD models for repository details * Fields: diff --git a/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll b/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll index 87a919359404..6a6ad6b70b16 100644 --- a/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll +++ b/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll @@ -9,6 +9,22 @@ extensible predicate workflowDataModel( string path, string trigger, string job, string secrets_source, string permissions, string runner ); +/** + * Holds if an external reusable workflow was downloaded for the given reference. + */ +extensible predicate externalReusableWorkflowDataModel( + string owner, string repo, string workflow_path, string requested_ref, string resolved_commit_sha, + string local_path +); + +/** + * Holds if an external composite action was downloaded for the given reference. + */ +extensible predicate externalCompositeActionDataModel( + string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha, + string local_path +); + /** * Holds if repository data model exists for the given parameters. */ diff --git a/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll b/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll index cf95292588c3..1ac9e93845b8 100644 --- a/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll +++ b/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll @@ -78,7 +78,7 @@ class DataFlowCall instanceof Cfg::Node { /** Gets a textual representation of this element. */ string toString() { result = super.toString() } - string getName() { result = super.getAstNode().(Uses).getCallee() } + string getName() { result = super.getAstNode().(UsesImpl).getCallableName() } DataFlowCallable getEnclosingCallable() { result = super.getScope() } diff --git a/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll b/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll index 3d5b8852b850..1af640672025 100644 --- a/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll +++ b/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll @@ -41,7 +41,7 @@ Event getRelevantCachePoisoningEventForSink(DataFlow::Node sink) { // the workflow caller runs in the context of the default branch result.getName() = "workflow_call" and exists(ExternalJob caller | - caller.getCallee() = job.getLocation().getFile().getRelativePath() and + job.getEnclosingWorkflow().(ReusableWorkflow).getACaller() = caller and runsOnDefaultBranch(caller.getATriggerEvent()) ) ) diff --git a/actions/ql/lib/ext/config/workflow_runtime_data.yml b/actions/ql/lib/ext/config/workflow_runtime_data.yml index f02a6bc20aa2..658b1a1f534e 100644 --- a/actions/ql/lib/ext/config/workflow_runtime_data.yml +++ b/actions/ql/lib/ext/config/workflow_runtime_data.yml @@ -7,3 +7,11 @@ extensions: pack: codeql/actions-all extensible: workflowDataModel data: [] + - addsTo: + pack: codeql/actions-all + extensible: externalReusableWorkflowDataModel + data: [] + - addsTo: + pack: codeql/actions-all + extensible: externalCompositeActionDataModel + data: [] diff --git a/actions/ql/test/external-reusable-workflows.model.yml b/actions/ql/test/external-reusable-workflows.model.yml new file mode 100644 index 000000000000..b20ef18e5250 --- /dev/null +++ b/actions/ql/test/external-reusable-workflows.model.yml @@ -0,0 +1,24 @@ +extensions: + - addsTo: + pack: codeql/actions-all + extensible: externalReusableWorkflowDataModel + data: + - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/reusable-workflow.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/publishResults.yml", "master", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/formal.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/build.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/build_nested.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/build_nested_branching.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/reusable.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml"] + - addsTo: + pack: codeql/actions-all + extensible: externalCompositeActionDataModel + data: + - ["TestOrg", "Actions", "remote", "v1", "dddddddddddddddddddddddddddddddddddddddd", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml"] + - ["TestOrg", "Actions", "remote", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml"] + - ["TestOrg", "TestRepo", ".github/actions/clone-repo", "main", "1111111111111111111111111111111111111111", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml"] + - ["ultralytics", "actions", "", "main", "2222222222222222222222222222222222222222", "9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml"] diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml b/actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml new file mode 100644 index 000000000000..0193b01a28a1 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml @@ -0,0 +1,7 @@ +name: Local leaf action +description: Completes an alternating local and remote action chain +runs: + using: composite + steps: + - shell: bash + run: echo complete diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml new file mode 100644 index 000000000000..e332cc09d146 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml @@ -0,0 +1,6 @@ +name: Local root action for v1 +description: Calls the v1 external action +runs: + using: composite + steps: + - uses: TestOrg/Actions/remote@v1 diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml new file mode 100644 index 000000000000..beaad908416b --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml @@ -0,0 +1,6 @@ +name: Local root action for v2 +description: Calls the v2 external action +runs: + using: composite + steps: + - uses: TestOrg/Actions/remote@v2 diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml b/actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml new file mode 100644 index 000000000000..e9556bc05922 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml @@ -0,0 +1,12 @@ +name: Call external composite actions through local actions + +on: + workflow_dispatch: {} + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: ./.github/actions/root-v1 + - uses: ./.github/actions/root-v2 + - uses: UnmodeledOrg/Actions/remote@main diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml new file mode 100644 index 000000000000..cf6368464fd5 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml @@ -0,0 +1,6 @@ +name: External action at v1 +description: Calls back into the analyzed repository +runs: + using: composite + steps: + - uses: ./.github/actions/leaf diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml new file mode 100644 index 000000000000..99c68a944e92 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml @@ -0,0 +1,6 @@ +name: External action at v2 +description: Calls back into the analyzed repository +runs: + using: composite + steps: + - uses: ./.github/actions/leaf diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ffffffffffffffffffffffffffffffffffffffff/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ffffffffffffffffffffffffffffffffffffffff/remote/action.yml new file mode 100644 index 000000000000..4525b936a9f1 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ffffffffffffffffffffffffffffffffffffffff/remote/action.yml @@ -0,0 +1,6 @@ +name: Unmodeled external action +description: Must not create caller or child call edges +runs: + using: composite + steps: + - uses: ./.github/actions/leaf diff --git a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected new file mode 100644 index 000000000000..fd35cebf5768 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected @@ -0,0 +1,6 @@ +| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | +| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | +| .github/actions/root-v1/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v1 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml | +| .github/actions/root-v2/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v2 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml | +| .github/workflows/caller.yml:10:9:11:6 | Uses Step | ./.github/actions/root-v1 | | .github/actions/root-v1/action.yml | +| .github/workflows/caller.yml:11:9:12:6 | Uses Step | ./.github/actions/root-v2 | | .github/actions/root-v2/action.yml | diff --git a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql new file mode 100644 index 000000000000..2757c758c0ea --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql @@ -0,0 +1,12 @@ +import actions + +string getVersion(UsesStep call) { + result = call.getVersion() + or + not exists(call.getVersion()) and result = "" +} + +from CompositeAction callee, UsesStep caller +where callee.getACallerStep() = caller +select caller, caller.getCallee(), getVersion(caller), + callee.getLocation().getFile().getRelativePath() diff --git a/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml new file mode 100644 index 000000000000..4e4a9d78a337 --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml @@ -0,0 +1,10 @@ +name: Call an external reusable workflow + +on: + workflow_dispatch: {} + +jobs: + first-v1: + uses: TestOrg/TestRepo/.github/workflows/first.yml@v1 + first-v2: + uses: TestOrg/TestRepo/.github/workflows/first.yml@v2 diff --git a/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml new file mode 100644 index 000000000000..2c132d536a43 --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml @@ -0,0 +1,8 @@ +name: Call an unmodeled external reusable workflow + +on: + workflow_dispatch: {} + +jobs: + legacy: + uses: LegacyOrg/LegacyRepo/.github/workflows/legacy.yml@main diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/legacy.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/legacy.yml new file mode 100644 index 000000000000..1a819b60ca89 --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/legacy.yml @@ -0,0 +1,6 @@ +name: Unmodeled external reusable workflow + +on: + workflow_call: {} + +jobs: {} diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml new file mode 100644 index 000000000000..f8881b97b90d --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml @@ -0,0 +1,8 @@ +name: First external reusable workflow + +on: + workflow_call: {} + +jobs: + second: + uses: ./.github/workflows/second.yml diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml new file mode 100644 index 000000000000..44bd49f66712 --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml @@ -0,0 +1,10 @@ +name: Second external reusable workflow + +on: + workflow_call: {} + +jobs: + complete: + runs-on: ubuntu-latest + steps: + - run: echo complete diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml new file mode 100644 index 000000000000..d1f80f6cc1e2 --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml @@ -0,0 +1,8 @@ +name: First external reusable workflow at v2 + +on: + workflow_call: {} + +jobs: + second: + uses: ./.github/workflows/second.yml diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml new file mode 100644 index 000000000000..02904995e71c --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml @@ -0,0 +1,10 @@ +name: Second external reusable workflow at v2 + +on: + workflow_call: {} + +jobs: + complete: + runs-on: ubuntu-latest + steps: + - run: echo complete diff --git a/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected new file mode 100644 index 000000000000..ad586e8f929a --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected @@ -0,0 +1,4 @@ +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml | +| .github/workflows/external_reusable_workflow.yml:8:5:9:2 | Job: first-v1 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml | +| .github/workflows/external_reusable_workflow.yml:10:5:10:58 | Job: first-v2 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml | diff --git a/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql new file mode 100644 index 000000000000..931fc5ca6544 --- /dev/null +++ b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql @@ -0,0 +1,5 @@ +import actions + +from ReusableWorkflow callee, ExternalJob caller +where callee.getACaller() = caller +select caller, caller.getCallee(), callee.getLocation().getFile().getRelativePath() diff --git a/actions/ql/test/qlpack.yml b/actions/ql/test/qlpack.yml index 139e8e57c62e..2608073099ca 100644 --- a/actions/ql/test/qlpack.yml +++ b/actions/ql/test/qlpack.yml @@ -10,3 +10,5 @@ dependencies: extractor: actions tests: . warnOnImplicitThis: true +dataExtensions: + - external-reusable-workflows.model.yml diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/ultralytics/actions/action.yaml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/ultralytics/actions/action.yaml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected index 9bf7e9aa56db..a6e9ef6f379d 100644 --- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected +++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected @@ -1,4 +1,15 @@ edges +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | provenance | | | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result2] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result2] | provenance | | @@ -8,12 +19,6 @@ edges | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | .github/actions/action5/action.yml:20:7:26:4 | Run Step: step [result] | provenance | | | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | .github/actions/action5/action.yml:14:13:14:46 | steps.step2.outputs.result2 | provenance | | | .github/actions/action5/action.yml:28:16:28:45 | github.event.issue.body | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | -| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | provenance | | | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | provenance | | | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | provenance | | | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | provenance | | @@ -49,7 +54,7 @@ edges | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | provenance | | | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | provenance | | | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | .github/workflows/composite-action-caller-4.yml:17:21:17:53 | steps.clone.outputs.result | provenance | | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | provenance | | @@ -57,11 +62,6 @@ edges | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:42:86:42:113 | env.ISSUE_BODY_PARSED | provenance | | | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | provenance | | | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | .github/workflows/cross3.yml:53:89:53:107 | env.pr_message | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | .github/workflows/image_link_generator.yml:25:25:25:68 | steps.extract-url.outputs.initial_url | provenance | | | .github/workflows/image_link_generator.yml:18:18:18:49 | github.event.comment.body | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | provenance | | | .github/workflows/image_link_generator.yml:22:9:28:6 | Run Step: curl [redirected_url] | .github/workflows/image_link_generator.yml:31:28:31:67 | steps.curl.outputs.redirected_url | provenance | | @@ -99,7 +99,7 @@ edges | .github/workflows/reusable-workflow-2.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/reusable-workflow-2.yml:66:34:66:52 | env.prev_log | provenance | | | .github/workflows/reusable-workflow-caller-1.yml:11:15:11:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/reusable-workflow-caller-2.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-2.yml:6:7:6:11 | input taint | provenance | | -| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | +| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | .github/workflows/self_needs.yml:20:15:20:51 | needs.test1.outputs.job_output | provenance | | | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | provenance | | | .github/workflows/self_needs.yml:13:9:19:6 | Uses Step: source [value] | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | provenance | | @@ -222,7 +222,7 @@ edges | .github/workflows/test27.yml:35:9:41:6 | Uses Step | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | semmle.label | input body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | @@ -260,15 +279,6 @@ nodes | .github/actions/action7/action.yml:214:41:214:69 | inputs.github_username | semmle.label | inputs.github_username | | .github/actions/action7/action.yml:215:41:215:66 | inputs.github_email | semmle.label | inputs.github_email | | .github/actions/action7/action.yml:217:25:217:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title | -| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | semmle.label | input body | -| .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | -| .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | semmle.label | Uses Step: remove_quotations [replaced] | | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | semmle.label | github.event.issue.title | | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | semmle.label | env.ISSUE_TITLE | @@ -341,16 +351,6 @@ nodes | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | semmle.label | github.event.discussion.title | | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | semmle.label | github.event.discussion.body | | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | semmle.label | github.event.comment.body | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | | .github/workflows/gollum.yml:7:19:7:52 | github.event.pages[1].title | semmle.label | github.event.pages[1].title | | .github/workflows/gollum.yml:8:19:8:53 | github.event.pages[11].title | semmle.label | github.event.pages[11].title | | .github/workflows/gollum.yml:9:19:9:56 | github.event.pages[0].page_name | semmle.label | github.event.pages[0].page_name | @@ -696,15 +696,20 @@ nodes | .github/workflows/workflow_run_branches5.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | subpaths | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | #select +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | ${{ inputs.title }} | .github/workflows/composite-action-caller-4.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | ${{ steps.git-commit.outputs.file-list }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | ${{ inputs.taint }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | ${{ env.log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | ${{ env.prev_log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | ${{ inputs.body }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | .github/workflows/composite-action-caller-1.yml:3:3:3:21 | pull_request_target | pull_request_target | | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | ${{ github.event.issue.body }} | .github/workflows/composite-action-caller-3.yml:3:3:3:15 | issue_comment | issue_comment | | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | ${{ inputs.taint }} | .github/workflows/composite-action-caller-3.yml:3:3:3:15 | issue_comment | issue_comment | | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test28.yml:12:3:12:21 | pull_request_target | pull_request_target | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | ${{ inputs.title }} | .github/workflows/composite-action-caller-4.yml:4:3:4:21 | pull_request_target | pull_request_target | -| .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | ${{ inputs.body }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | -| .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | ${{steps.remove_quotations.outputs.replaced}} | .github/workflows/argus_case_study.yml:4:3:4:8 | issues | issues | | .github/workflows/artifactpoisoning1.yml:27:67:27:92 | steps.pr.outputs.id | .github/workflows/artifactpoisoning1.yml:14:9:20:6 | Uses Step | .github/workflows/artifactpoisoning1.yml:27:67:27:92 | steps.pr.outputs.id | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning1.yml:27:67:27:92 | steps.pr.outputs.id | ${{ steps.pr.outputs.id }} | .github/workflows/artifactpoisoning1.yml:4:3:4:14 | workflow_run | workflow_run | | .github/workflows/artifactpoisoning2.yml:22:17:22:42 | steps.pr.outputs.id | .github/workflows/artifactpoisoning2.yml:13:9:19:6 | Uses Step: pr | .github/workflows/artifactpoisoning2.yml:22:17:22:42 | steps.pr.outputs.id | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning2.yml:22:17:22:42 | steps.pr.outputs.id | ${{ steps.pr.outputs.id }} | .github/workflows/artifactpoisoning2.yml:4:3:4:14 | workflow_run | workflow_run | @@ -733,11 +738,6 @@ subpaths | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | ${{ github.event.discussion.title }} | .github/workflows/discussion_comment.yml:1:5:1:22 | discussion_comment | discussion_comment | | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | ${{ github.event.discussion.body }} | .github/workflows/discussion_comment.yml:1:5:1:22 | discussion_comment | discussion_comment | | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/discussion_comment.yml:1:5:1:22 | discussion_comment | discussion_comment | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | ${{ steps.git-commit.outputs.file-list }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | ${{ inputs.taint }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | ${{ env.log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | ${{ env.prev_log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | | .github/workflows/image_link_generator.yml:37:85:37:125 | steps.trim-url.outputs.trimmed_url | .github/workflows/image_link_generator.yml:18:18:18:49 | github.event.comment.body | .github/workflows/image_link_generator.yml:37:85:37:125 | steps.trim-url.outputs.trimmed_url | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/image_link_generator.yml:37:85:37:125 | steps.trim-url.outputs.trimmed_url | ${{ steps.trim-url.outputs.trimmed_url }} | .github/workflows/image_link_generator.yml:4:3:4:15 | issue_comment | issue_comment | | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | ${{ github.event.issue.title }} | .github/workflows/issues.yaml:1:5:1:10 | issues | issues | | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | ${{ github.event.issue.body }} | .github/workflows/issues.yaml:1:5:1:10 | issues | issues | diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected index 4bbe7da0aaf3..ad99cfdb75a8 100644 --- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected +++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected @@ -1,4 +1,15 @@ edges +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | provenance | | | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result2] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result2] | provenance | | @@ -8,12 +19,6 @@ edges | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | .github/actions/action5/action.yml:20:7:26:4 | Run Step: step [result] | provenance | | | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | .github/actions/action5/action.yml:14:13:14:46 | steps.step2.outputs.result2 | provenance | | | .github/actions/action5/action.yml:28:16:28:45 | github.event.issue.body | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | -| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | provenance | | | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | provenance | | | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | provenance | | | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | provenance | | @@ -49,7 +54,7 @@ edges | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | provenance | | | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | provenance | | | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | .github/workflows/composite-action-caller-4.yml:17:21:17:53 | steps.clone.outputs.result | provenance | | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | provenance | | @@ -57,11 +62,6 @@ edges | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:42:86:42:113 | env.ISSUE_BODY_PARSED | provenance | | | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | provenance | | | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | .github/workflows/cross3.yml:53:89:53:107 | env.pr_message | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | .github/workflows/image_link_generator.yml:25:25:25:68 | steps.extract-url.outputs.initial_url | provenance | | | .github/workflows/image_link_generator.yml:18:18:18:49 | github.event.comment.body | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | provenance | | | .github/workflows/image_link_generator.yml:22:9:28:6 | Run Step: curl [redirected_url] | .github/workflows/image_link_generator.yml:31:28:31:67 | steps.curl.outputs.redirected_url | provenance | | @@ -99,7 +99,7 @@ edges | .github/workflows/reusable-workflow-2.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/reusable-workflow-2.yml:66:34:66:52 | env.prev_log | provenance | | | .github/workflows/reusable-workflow-caller-1.yml:11:15:11:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/reusable-workflow-caller-2.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-2.yml:6:7:6:11 | input taint | provenance | | -| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | +| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | .github/workflows/self_needs.yml:20:15:20:51 | needs.test1.outputs.job_output | provenance | | | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | provenance | | | .github/workflows/self_needs.yml:13:9:19:6 | Uses Step: source [value] | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | provenance | | @@ -222,7 +222,7 @@ edges | .github/workflows/test27.yml:35:9:41:6 | Uses Step | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | semmle.label | input body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | @@ -260,15 +279,6 @@ nodes | .github/actions/action7/action.yml:214:41:214:69 | inputs.github_username | semmle.label | inputs.github_username | | .github/actions/action7/action.yml:215:41:215:66 | inputs.github_email | semmle.label | inputs.github_email | | .github/actions/action7/action.yml:217:25:217:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] | -| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title | -| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | semmle.label | input body | -| .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | -| .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | semmle.label | Uses Step: remove_quotations [replaced] | | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | semmle.label | github.event.issue.title | | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | semmle.label | env.ISSUE_TITLE | @@ -341,16 +351,6 @@ nodes | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | semmle.label | github.event.discussion.title | | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | semmle.label | github.event.discussion.body | | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | semmle.label | github.event.comment.body | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | | .github/workflows/gollum.yml:7:19:7:52 | github.event.pages[1].title | semmle.label | github.event.pages[1].title | | .github/workflows/gollum.yml:8:19:8:53 | github.event.pages[11].title | semmle.label | github.event.pages[11].title | | .github/workflows/gollum.yml:9:19:9:56 | github.event.pages[0].page_name | semmle.label | github.event.pages[0].page_name | @@ -696,7 +696,7 @@ nodes | .github/workflows/workflow_run_branches5.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | subpaths | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | #select | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected index b6c349bd64fe..85598a30b05c 100644 --- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected +++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected @@ -1,4 +1,9 @@ edges +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml:11:9:19:6 | Uses Step: checkAccess | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml:19:9:25:2 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:14:9:19:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:19:9:25:6 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:19:9:25:6 | Run Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:25:9:70:20 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:26:9:29:7 | Run Step | | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:11:7:12:18 | Run Step | | .github/actions/dangerous-git-checkout/action.yml:11:7:12:18 | Run Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/actions/download-artifact-2/action.yaml:25:7:29:4 | Run Step | @@ -93,11 +98,6 @@ edges | .github/workflows/dependabot3.yml:15:9:20:6 | Uses Step | .github/workflows/dependabot3.yml:20:9:25:6 | Uses Step | | .github/workflows/dependabot3.yml:20:9:25:6 | Uses Step | .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone | | .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone | .github/workflows/dependabot3.yml:48:9:52:57 | Run Step | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml:11:9:19:6 | Uses Step: checkAccess | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml:19:9:25:2 | Run Step | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:14:9:19:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:19:9:25:6 | Run Step | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:19:9:25:6 | Run Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:25:9:70:20 | Run Step | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:26:9:29:7 | Run Step | | .github/workflows/gitcheckout.yml:10:11:18:8 | Run Step | .github/workflows/gitcheckout.yml:18:11:21:8 | Uses Step | | .github/workflows/gitcheckout.yml:18:11:21:8 | Uses Step | .github/workflows/gitcheckout.yml:21:11:23:22 | Run Step | | .github/workflows/issue_comment_3rd_party_action.yml:12:9:16:6 | Uses Step: comment-branch | .github/workflows/issue_comment_3rd_party_action.yml:16:9:22:2 | Uses Step | @@ -351,16 +351,16 @@ edges | .github/workflows/workflow_run_untrusted_checkout_2.yml:13:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_2.yml:16:9:18:31 | Uses Step | | .github/workflows/workflow_run_untrusted_checkout_3.yml:13:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_3.yml:16:9:18:31 | Uses Step | #select +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:2:3:2:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_branching_nested.yml:2:3:2:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_no_needs.yml:2:3:2:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:26:9:29:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/reusable_caller1.yaml:4:3:4:21 | pull_request_target | pull_request_target | | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout3.yml:4:3:4:14 | workflow_run | workflow_run | | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:32:9:37:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target | | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:48:9:52:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target | | .github/workflows/auto_ci.yml:67:9:74:6 | Uses Step | .github/workflows/auto_ci.yml:67:9:74:6 | Uses Step | .github/workflows/auto_ci.yml:79:9:84:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target | | .github/workflows/auto_ci.yml:67:9:74:6 | Uses Step | .github/workflows/auto_ci.yml:67:9:74:6 | Uses Step | .github/workflows/auto_ci.yml:84:9:93:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target | | .github/workflows/dependabot3.yml:15:9:20:6 | Uses Step | .github/workflows/dependabot3.yml:15:9:20:6 | Uses Step | .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/dependabot3.yml:3:5:3:23 | pull_request_target | pull_request_target | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:2:3:2:21 | pull_request_target | pull_request_target | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_branching_nested.yml:2:3:2:21 | pull_request_target | pull_request_target | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_no_needs.yml:2:3:2:21 | pull_request_target | pull_request_target | -| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:26:9:29:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/reusable_caller1.yaml:4:3:4:21 | pull_request_target | pull_request_target | | .github/workflows/gitcheckout.yml:10:11:18:8 | Run Step | .github/workflows/gitcheckout.yml:10:11:18:8 | Run Step | .github/workflows/gitcheckout.yml:21:11:23:22 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/gitcheckout.yml:2:3:2:21 | pull_request_target | pull_request_target | | .github/workflows/label_trusted_checkout2.yml:12:7:16:4 | Uses Step | .github/workflows/label_trusted_checkout2.yml:12:7:16:4 | Uses Step | .github/workflows/label_trusted_checkout2.yml:17:7:21:4 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/label_trusted_checkout2.yml:2:3:2:21 | pull_request_target | pull_request_target | | .github/workflows/level0.yml:99:9:103:6 | Uses Step | .github/workflows/level0.yml:99:9:103:6 | Uses Step | .github/workflows/level0.yml:107:9:112:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/level0.yml:5:3:5:15 | issue_comment | issue_comment | diff --git a/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst b/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst index 0b78b37359f4..55fda4b2dfcc 100644 --- a/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst +++ b/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst @@ -32,6 +32,8 @@ Customizing Actions-specific analysis: - ``argumentInjectionSinksDataModel(regexp, command_group, argument_group)`` - ``contextTriggerDataModel(trigger, context_prefix)`` +- ``externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha, local_path)`` +- ``externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, resolved_commit_sha, local_path)`` - ``externallyTriggerableEventsDataModel(event)`` - ``immutableActionsDataModel(action)`` - ``poisonableActionsDataModel(action)`` From 9c4c1a42dc0e164c629d4555137d6168800cb1d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= Date: Sat, 18 Jul 2026 09:36:23 +0000 Subject: [PATCH 2/7] Update tests for the latest changes in extractor --- .../external-reusable-workflows.model.yml | 30 +++---- .../remote/action.yml | 0 .../remote/action.yml | 0 .../remote/action.yml | 0 .../external_composite_actions.expected | 8 +- .../.github/workflows/legacy.yml | 0 .../.github/workflows/first.yml | 0 .../.github/workflows/second.yml | 0 .../.github/workflows/first.yml | 0 .../.github/workflows/second.yml | 0 .../external_reusable_workflows.expected | 8 +- .../.github/actions/clone-repo/action.yaml | 0 .../.github/workflows/reusable-workflow.yml | 0 .../.github/workflows/publishResults.yml | 0 .../action.yaml | 0 .../CWE-094/CodeInjectionCritical.expected | 84 +++++++++---------- .../CWE-094/CodeInjectionMedium.expected | 68 +++++++-------- .../.github/workflows/build.yml | 0 .../.github/workflows/build_nested.yml | 0 .../workflows/build_nested_branching.yml | 0 .../.github/workflows/formal.yml | 0 .../.github/workflows/reusable.yml | 0 .../UntrustedCheckoutCritical.expected | 18 ++-- 23 files changed, 108 insertions(+), 108 deletions(-) rename actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/{dddddddddddddddddddddddddddddddddddddddd => ref-0wu7t20oora8i}/remote/action.yml (100%) rename actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/{eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee => ref-3tf7yq1278i0t}/remote/action.yml (100%) rename actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/{ffffffffffffffffffffffffffffffffffffffff => ref-0wu7t20oora8i}/remote/action.yml (100%) rename actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-07cp61dt7qne3}/.github/workflows/legacy.yml (100%) rename actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa => ref-0wu7t20oora8i}/.github/workflows/first.yml (100%) rename actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa => ref-0wu7t20oora8i}/.github/workflows/second.yml (100%) rename actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb => ref-3tf7yq1278i0t}/.github/workflows/first.yml (100%) rename actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb => ref-3tf7yq1278i0t}/.github/workflows/second.yml (100%) rename actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{1111111111111111111111111111111111111111 => ref-07cp61dt7qne3}/.github/actions/clone-repo/action.yaml (100%) rename actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-07cp61dt7qne3}/.github/workflows/reusable-workflow.yml (100%) rename actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-3u61h4t2rfnaf}/.github/workflows/publishResults.yml (100%) rename actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/{2222222222222222222222222222222222222222 => ref-07cp61dt7qne3}/action.yaml (100%) rename actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-07cp61dt7qne3}/.github/workflows/build.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-07cp61dt7qne3}/.github/workflows/build_nested.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-07cp61dt7qne3}/.github/workflows/build_nested_branching.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-07cp61dt7qne3}/.github/workflows/formal.yml (100%) rename actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/{cccccccccccccccccccccccccccccccccccccccc => ref-07cp61dt7qne3}/.github/workflows/reusable.yml (100%) diff --git a/actions/ql/test/external-reusable-workflows.model.yml b/actions/ql/test/external-reusable-workflows.model.yml index b20ef18e5250..c34a98113206 100644 --- a/actions/ql/test/external-reusable-workflows.model.yml +++ b/actions/ql/test/external-reusable-workflows.model.yml @@ -3,22 +3,22 @@ extensions: pack: codeql/actions-all extensible: externalReusableWorkflowDataModel data: - - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/reusable-workflow.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/publishResults.yml", "master", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/formal.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/build.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/build_nested.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/build_nested_branching.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml"] - - ["TestOrg", "TestRepo", ".github/workflows/reusable.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/reusable-workflow.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/publishResults.yml", "master", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/formal.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/build.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/build_nested.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/build_nested_branching.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml"] + - ["TestOrg", "TestRepo", ".github/workflows/reusable.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml"] - addsTo: pack: codeql/actions-all extensible: externalCompositeActionDataModel data: - - ["TestOrg", "Actions", "remote", "v1", "dddddddddddddddddddddddddddddddddddddddd", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml"] - - ["TestOrg", "Actions", "remote", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml"] - - ["TestOrg", "TestRepo", ".github/actions/clone-repo", "main", "1111111111111111111111111111111111111111", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml"] - - ["ultralytics", "actions", "", "main", "2222222222222222222222222222222222222222", "9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml"] + - ["TestOrg", "Actions", "remote", "v1", "dddddddddddddddddddddddddddddddddddddddd", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml"] + - ["TestOrg", "Actions", "remote", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml"] + - ["TestOrg", "TestRepo", ".github/actions/clone-repo", "main", "1111111111111111111111111111111111111111", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml"] + - ["ultralytics", "actions", "", "main", "2222222222222222222222222222222222222222", "9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml"] diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml similarity index 100% rename from actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml rename to actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml similarity index 100% rename from actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml rename to actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ffffffffffffffffffffffffffffffffffffffff/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ref-0wu7t20oora8i/remote/action.yml similarity index 100% rename from actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ffffffffffffffffffffffffffffffffffffffff/remote/action.yml rename to actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ref-0wu7t20oora8i/remote/action.yml diff --git a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected index fd35cebf5768..7695b1e58c94 100644 --- a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected +++ b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected @@ -1,6 +1,6 @@ -| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | -| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | -| .github/actions/root-v1/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v1 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/dddddddddddddddddddddddddddddddddddddddd/remote/action.yml | -| .github/actions/root-v2/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v2 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/remote/action.yml | +| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | +| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | +| .github/actions/root-v1/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v1 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml | +| .github/actions/root-v2/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v2 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml | | .github/workflows/caller.yml:10:9:11:6 | Uses Step | ./.github/actions/root-v1 | | .github/actions/root-v1/action.yml | | .github/workflows/caller.yml:11:9:12:6 | Uses Step | ./.github/actions/root-v2 | | .github/actions/root-v2/action.yml | diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/legacy.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/ref-07cp61dt7qne3/.github/workflows/legacy.yml similarity index 100% rename from actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/legacy.yml rename to actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/ref-07cp61dt7qne3/.github/workflows/legacy.yml diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml similarity index 100% rename from actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml rename to actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml similarity index 100% rename from actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml rename to actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml similarity index 100% rename from actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml rename to actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml similarity index 100% rename from actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml rename to actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml diff --git a/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected index ad586e8f929a..c56b6f7978f0 100644 --- a/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected +++ b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected @@ -1,4 +1,4 @@ -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/second.yml | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/second.yml | -| .github/workflows/external_reusable_workflow.yml:8:5:9:2 | Job: first-v1 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/first.yml | -| .github/workflows/external_reusable_workflow.yml:10:5:10:58 | Job: first-v2 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/first.yml | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml | +| .github/workflows/external_reusable_workflow.yml:8:5:9:2 | Job: first-v1 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml | +| .github/workflows/external_reusable_workflow.yml:10:5:10:58 | Job: first-v2 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml | diff --git a/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml diff --git a/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml diff --git a/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml diff --git a/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected index a6e9ef6f379d..8f3bf4c81d83 100644 --- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected +++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected @@ -1,15 +1,15 @@ edges -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | provenance | | | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result2] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result2] | provenance | | @@ -54,7 +54,7 @@ edges | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | provenance | | | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | provenance | | | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | .github/workflows/composite-action-caller-4.yml:17:21:17:53 | steps.clone.outputs.result | provenance | | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | provenance | | @@ -99,7 +99,7 @@ edges | .github/workflows/reusable-workflow-2.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/reusable-workflow-2.yml:66:34:66:52 | env.prev_log | provenance | | | .github/workflows/reusable-workflow-caller-1.yml:11:15:11:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/reusable-workflow-caller-2.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-2.yml:6:7:6:11 | input taint | provenance | | -| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | +| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | .github/workflows/self_needs.yml:20:15:20:51 | needs.test1.outputs.job_output | provenance | | | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | provenance | | | .github/workflows/self_needs.yml:13:9:19:6 | Uses Step: source [value] | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | provenance | | @@ -222,7 +222,7 @@ edges | .github/workflows/test27.yml:35:9:41:6 | Uses Step | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | semmle.label | input body | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | semmle.label | input body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | @@ -696,16 +696,16 @@ nodes | .github/workflows/workflow_run_branches5.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | subpaths | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | #select -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | ${{ inputs.title }} | .github/workflows/composite-action-caller-4.yml:4:3:4:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | ${{ steps.git-commit.outputs.file-list }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | ${{ inputs.taint }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | ${{ env.log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | ${{ env.prev_log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | ${{ inputs.body }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | ${{ steps.git-commit.outputs.file-list }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | ${{ inputs.title }} | .github/workflows/composite-action-caller-4.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | ${{ inputs.taint }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | ${{ env.log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | ${{ env.prev_log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | ${{ inputs.body }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target | | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | .github/workflows/composite-action-caller-1.yml:3:3:3:21 | pull_request_target | pull_request_target | | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | ${{ github.event.issue.body }} | .github/workflows/composite-action-caller-3.yml:3:3:3:15 | issue_comment | issue_comment | | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | ${{ inputs.taint }} | .github/workflows/composite-action-caller-3.yml:3:3:3:15 | issue_comment | issue_comment | diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected index ad99cfdb75a8..d5cca44534cf 100644 --- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected +++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected @@ -1,15 +1,15 @@ edges -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance | | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance | | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | provenance | | | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | provenance | | | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result2] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result2] | provenance | | @@ -54,7 +54,7 @@ edges | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | provenance | | | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | provenance | | | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | .github/workflows/composite-action-caller-4.yml:17:21:17:53 | steps.clone.outputs.result | provenance | | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance | | | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | provenance | | | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | provenance | | @@ -99,7 +99,7 @@ edges | .github/workflows/reusable-workflow-2.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/reusable-workflow-2.yml:66:34:66:52 | env.prev_log | provenance | | | .github/workflows/reusable-workflow-caller-1.yml:11:15:11:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/reusable-workflow-caller-2.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-2.yml:6:7:6:11 | input taint | provenance | | -| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | +| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance | | | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | .github/workflows/self_needs.yml:20:15:20:51 | needs.test1.outputs.job_output | provenance | | | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | provenance | | | .github/workflows/self_needs.yml:13:9:19:6 | Uses Step: source [value] | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | provenance | | @@ -222,7 +222,7 @@ edges | .github/workflows/test27.yml:35:9:41:6 | Uses Step | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:66:3:66:6 | input body | semmle.label | input body | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | -| 9466014afba34ef28239871ceabf4132/ultralytics/actions/2222222222222222222222222222222222222222/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n 'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | semmle.label | input body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body | +| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref | | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body | @@ -696,7 +696,7 @@ nodes | .github/workflows/workflow_run_branches5.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch | subpaths | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | -| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/1111111111111111111111111111111111111111/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | +| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | #select | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | diff --git a/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml similarity index 100% rename from actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml diff --git a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected index 85598a30b05c..8bb5afca75ab 100644 --- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected +++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected @@ -1,9 +1,9 @@ edges -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml:11:9:19:6 | Uses Step: checkAccess | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build_nested_branching.yml:19:9:25:2 | Run Step | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:14:9:19:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:19:9:25:6 | Run Step | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:19:9:25:6 | Run Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/formal.yml:25:9:70:20 | Run Step | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:26:9:29:7 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml:11:9:19:6 | Uses Step: checkAccess | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml:19:9:25:2 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:14:9:19:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:19:9:25:6 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:19:9:25:6 | Run Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:25:9:70:20 | Run Step | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:26:9:29:7 | Run Step | | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:11:7:12:18 | Run Step | | .github/actions/dangerous-git-checkout/action.yml:11:7:12:18 | Run Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/actions/download-artifact-2/action.yaml:25:7:29:4 | Run Step | @@ -351,10 +351,10 @@ edges | .github/workflows/workflow_run_untrusted_checkout_2.yml:13:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_2.yml:16:9:18:31 | Uses Step | | .github/workflows/workflow_run_untrusted_checkout_3.yml:13:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_3.yml:16:9:18:31 | Uses Step | #select -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:2:3:2:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_branching_nested.yml:2:3:2:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_no_needs.yml:2:3:2:21 | pull_request_target | pull_request_target | -| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/cccccccccccccccccccccccccccccccccccccccc/.github/workflows/reusable.yml:26:9:29:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/reusable_caller1.yaml:4:3:4:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:2:3:2:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_branching_nested.yml:2:3:2:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permission_check_reusable_no_needs.yml:2:3:2:21 | pull_request_target | pull_request_target | +| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:26:9:29:7 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/reusable_caller1.yaml:4:3:4:21 | pull_request_target | pull_request_target | | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout3.yml:4:3:4:14 | workflow_run | workflow_run | | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:32:9:37:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target | | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:48:9:52:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target | From 38ffa2607d462379c3e12713d68ff9e186f65d1f Mon Sep 17 00:00:00 2001 From: JarLob Date: Thu, 30 Jul 2026 21:58:38 +0300 Subject: [PATCH 3/7] Format external Actions model support --- .../lib/codeql/actions/ast/internal/Ast.qll | 92 ++++++++++--------- 1 file changed, 49 insertions(+), 43 deletions(-) diff --git a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll index 6721a7ad1462..2a4e951c4de8 100644 --- a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll +++ b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll @@ -424,34 +424,34 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction { } predicate getAnExternalCompositeActionModel( - string owner, string repo, string action_path, string requested_ref, - string resolved_commit_sha, string local_path + string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha, + string local_path ) { - externalCompositeActionDataModel(owner, repo, action_path, requested_ref, - resolved_commit_sha, local_path) and + externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha, + local_path) and local_path.trim() = this.getLocation().getFile().getRelativePath() } predicate isExternalCompositeAction() { - exists(string owner, string repo, string action_path, string requested_ref, - string resolved_commit_sha, string local_path | + exists( + string owner, string repo, string action_path, string requested_ref, + string resolved_commit_sha, string local_path + | this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, resolved_commit_sha, local_path) ) or - this.getLocation() - .getFile() - .getRelativePath() - .matches("9466014afba34ef28239871ceabf4132/%") + this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%") } string getResolvedPath() { - exists(string owner, string repo, string action_path, string requested_ref, - string resolved_commit_sha, string local_path | + exists( + string owner, string repo, string action_path, string requested_ref, + string resolved_commit_sha, string local_path + | this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, resolved_commit_sha, local_path) and - result = - externalCompositeActionName(owner, repo, action_path) + "@" + requested_ref.trim() + result = externalCompositeActionName(owner, repo, action_path) + "@" + requested_ref.trim() ) or not this.isExternalCompositeAction() and @@ -590,35 +590,31 @@ class ReusableWorkflowImpl extends AstNodeImpl, WorkflowImpl { } predicate isExternalReusableWorkflow() { - exists(string owner, string repo, string workflow_path, string requested_ref, - string resolved_commit_sha, string local_path | + exists( + string owner, string repo, string workflow_path, string requested_ref, + string resolved_commit_sha, string local_path + | this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, resolved_commit_sha, local_path) ) or - this.getLocation() - .getFile() - .getRelativePath() - .matches("9466014afba34ef28239871ceabf4132/%") // root folder for external workflows and composite actions + this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%") // root folder for external workflows and composite actions } string getResolvedPath() { - exists(string owner, string repo, string workflow_path, string requested_ref, - string resolved_commit_sha, string local_path | + exists( + string owner, string repo, string workflow_path, string requested_ref, + string resolved_commit_sha, string local_path + | this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, resolved_commit_sha, local_path) and result = - owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() + "@" + - requested_ref.trim() + owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() + "@" + requested_ref.trim() ) or not this.isExternalReusableWorkflow() and result = - ["", "./"] + - this.getLocation() - .getFile() - .getRelativePath() - .replaceAll(getRepoRoot(), "") + ["", "./"] + this.getLocation().getFile().getRelativePath().replaceAll(getRepoRoot(), "") } } @@ -1448,10 +1444,12 @@ class UsesStepImpl extends StepImpl, UsesImpl { private predicate isLocalCall() { u.getValue().matches(["./%", ".github/%"]) } private predicate hasModeledExternalCallee() { - exists(string owner, string repo, string action_path, string requested_ref, - string resolved_commit_sha, string local_path | - externalCompositeActionDataModel(owner, repo, action_path, requested_ref, - resolved_commit_sha, local_path) and + exists( + string owner, string repo, string action_path, string requested_ref, + string resolved_commit_sha, string local_path + | + externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha, + local_path) and this.getCallee() = externalCompositeActionName(owner, repo, action_path) and this.getVersion() = requested_ref.trim() ) @@ -1464,11 +1462,14 @@ class UsesStepImpl extends StepImpl, UsesImpl { } private predicate hasModeledExternalEnclosingCompositeAction() { - exists(CompositeActionImpl action, string owner, string repo, string action_path, - string requested_ref, string resolved_commit_sha, string local_path | + exists( + CompositeActionImpl action, string owner, string repo, string action_path, + string requested_ref, string resolved_commit_sha, string local_path + | action = this.getEnclosingCompositeAction() and - action.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, - resolved_commit_sha, local_path) + action + .getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) ) } @@ -1531,8 +1532,10 @@ class ExternalJobImpl extends JobImpl, UsesImpl { } private predicate hasModeledExternalCallee() { - exists(string owner, string repo, string workflow_path, string requested_ref, - string resolved_commit_sha, string local_path | + exists( + string owner, string repo, string workflow_path, string requested_ref, + string resolved_commit_sha, string local_path + | externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, resolved_commit_sha, local_path) and this.getCallee() = owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() and @@ -1542,11 +1545,14 @@ class ExternalJobImpl extends JobImpl, UsesImpl { override string getCallableName() { this.isLocalCall() and - exists(ReusableWorkflowImpl enclosing_workflow, string owner, string repo, string workflow_path, - string requested_ref, string resolved_commit_sha, string local_path | + exists( + ReusableWorkflowImpl enclosing_workflow, string owner, string repo, string workflow_path, + string requested_ref, string resolved_commit_sha, string local_path + | enclosing_workflow = this.getEnclosingWorkflow() and - enclosing_workflow.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, - resolved_commit_sha, local_path) and + enclosing_workflow + .getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, + resolved_commit_sha, local_path) and result = owner.trim() + "/" + repo.trim() + "/" + this.getCallee() + "@" + requested_ref.trim() ) From f3f6b42ed4286c757e8e0df6c055243a3029b770 Mon Sep 17 00:00:00 2001 From: JarLob Date: Fri, 31 Jul 2026 12:14:35 +0300 Subject: [PATCH 4/7] Add change note --- .../src/change-notes/2026-07-31-external-workflow-models.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 actions/ql/src/change-notes/2026-07-31-external-workflow-models.md diff --git a/actions/ql/src/change-notes/2026-07-31-external-workflow-models.md b/actions/ql/src/change-notes/2026-07-31-external-workflow-models.md new file mode 100644 index 000000000000..60be5d93be6e --- /dev/null +++ b/actions/ql/src/change-notes/2026-07-31-external-workflow-models.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Update GitHub Actions analysis to model versioned downloaded external reusable workflows and composite actions. \ No newline at end of file From 52ee51bd9f49da659c3374b3db013c4551b03c29 Mon Sep 17 00:00:00 2001 From: JarLob Date: Fri, 31 Jul 2026 16:48:24 +0300 Subject: [PATCH 5/7] Support self-repository external references Resolve $/ paths in downloaded reusable workflows and composite actions against their modeled repository, and cover both forms while retaining ./ compatibility. --- .../lib/codeql/actions/ast/internal/Ast.qll | 38 +++++++++++++++---- .../external-reusable-workflows.model.yml | 1 + .../.github/actions/leaf/action.yml | 7 ++++ .../ref-3tf7yq1278i0t/remote/action.yml | 4 +- .../external_composite_actions.expected | 2 +- .../.github/workflows/first.yml | 2 +- 6 files changed, 43 insertions(+), 11 deletions(-) create mode 100644 actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml diff --git a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll index 2a4e951c4de8..419d9d34e188 100644 --- a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll +++ b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll @@ -1441,7 +1441,11 @@ class UsesStepImpl extends StepImpl, UsesImpl { else result = u.getValue() } - private predicate isLocalCall() { u.getValue().matches(["./%", ".github/%"]) } + private predicate isWorkspaceLocalCall() { u.getValue().matches(["./%", ".github/%"]) } + + private predicate isSelfCall() { u.getValue().matches("$/%") } + + private predicate isLocalCall() { this.isWorkspaceLocalCall() or this.isSelfCall() } private predicate hasModeledExternalCallee() { exists( @@ -1473,8 +1477,26 @@ class UsesStepImpl extends StepImpl, UsesImpl { ) } + private string getSelfCallableName() { + exists( + CompositeActionImpl action, string owner, string repo, string action_path, + string requested_ref, string resolved_commit_sha, string local_path + | + action = this.getEnclosingCompositeAction() and + action + .getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, + resolved_commit_sha, local_path) and + result = + externalCompositeActionName(owner, repo, this.getCallee().suffix(2)) + "@" + + requested_ref.trim() + ) + or + not this.hasExternalEnclosingCompositeAction() and + result = this.getCallee().suffix(2) + } + override string getCallableName() { - this.isLocalCall() and + this.isWorkspaceLocalCall() and ( this.hasModeledExternalEnclosingCompositeAction() or @@ -1482,6 +1504,9 @@ class UsesStepImpl extends StepImpl, UsesImpl { ) and result = this.getCallee() or + this.isSelfCall() and + result = this.getSelfCallableName() + or not this.isLocalCall() and this.hasModeledExternalCallee() and result = this.getCallee() + "@" + this.getVersion() @@ -1501,20 +1526,19 @@ class UsesStepImpl extends StepImpl, UsesImpl { * Gets a regular expression that parses an `owner/repo@version` reference within a `uses` field in an Actions job step. * local repo: octo-org/this-repo/.github/workflows/workflow-1.yml@172239021f7ba04fe7327647b213799853a9eb89 * local repo: ./.github/workflows/workflow-2.yml + * local repo: $/.github/workflows/workflow-2.yml * remote repo: octo-org/another-repo/.github/workflows/workflow.yml@v1 */ private string repoUsesParser() { result = "([^/]+)/([^/]+)/([^@]+)@(.+)" } -private string pathUsesParser() { result = "\\./(.+)" } - class ExternalJobImpl extends JobImpl, UsesImpl { YamlScalar u; ExternalJobImpl() { n.lookup("uses") = u } override string getCallee() { - if u.getValue().matches("./%") - then result = u.getValue().regexpCapture(pathUsesParser(), 1) + if u.getValue().matches(["./%", "$/%"]) + then result = u.getValue().suffix(2) else result = u.getValue().regexpCapture(repoUsesParser(), 1) + "/" + @@ -1522,7 +1546,7 @@ class ExternalJobImpl extends JobImpl, UsesImpl { u.getValue().regexpCapture(repoUsesParser(), 3) } - private predicate isLocalCall() { u.getValue().matches("./%") } + private predicate isLocalCall() { u.getValue().matches(["./%", "$/%"]) } private predicate hasExternalEnclosingWorkflow() { exists(ReusableWorkflowImpl enclosing_workflow | diff --git a/actions/ql/test/external-reusable-workflows.model.yml b/actions/ql/test/external-reusable-workflows.model.yml index c34a98113206..a753501a86ed 100644 --- a/actions/ql/test/external-reusable-workflows.model.yml +++ b/actions/ql/test/external-reusable-workflows.model.yml @@ -20,5 +20,6 @@ extensions: data: - ["TestOrg", "Actions", "remote", "v1", "dddddddddddddddddddddddddddddddddddddddd", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml"] - ["TestOrg", "Actions", "remote", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml"] + - ["TestOrg", "Actions", ".github/actions/leaf", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml"] - ["TestOrg", "TestRepo", ".github/actions/clone-repo", "main", "1111111111111111111111111111111111111111", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml"] - ["ultralytics", "actions", "", "main", "2222222222222222222222222222222222222222", "9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml"] diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml new file mode 100644 index 000000000000..8a67d11b7c77 --- /dev/null +++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml @@ -0,0 +1,7 @@ +name: External leaf action at v2 +description: Completes a self-repository action chain +runs: + using: composite + steps: + - shell: bash + run: echo complete \ No newline at end of file diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml index 99c68a944e92..82d159fab76b 100644 --- a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml +++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml @@ -1,6 +1,6 @@ name: External action at v2 -description: Calls back into the analyzed repository +description: Calls an action in the same external repository runs: using: composite steps: - - uses: ./.github/actions/leaf + - uses: $/.github/actions/leaf diff --git a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected index 7695b1e58c94..085661ee61d8 100644 --- a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected +++ b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected @@ -1,5 +1,5 @@ | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | -| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf | | .github/actions/leaf/action.yml | +| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml:6:7:6:35 | Uses Step | $/.github/actions/leaf | | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml | | .github/actions/root-v1/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v1 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml | | .github/actions/root-v2/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v2 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml | | .github/workflows/caller.yml:10:9:11:6 | Uses Step | ./.github/actions/root-v1 | | .github/actions/root-v1/action.yml | diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml index d1f80f6cc1e2..de52bf33c34a 100644 --- a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml +++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml @@ -5,4 +5,4 @@ on: jobs: second: - uses: ./.github/workflows/second.yml + uses: $/.github/workflows/second.yml From 558a0e00674533c173b76b12199702a7f1f7c013 Mon Sep 17 00:00:00 2001 From: JarLob Date: Fri, 31 Jul 2026 17:22:06 +0300 Subject: [PATCH 6/7] Address QL-for-QL review findings Rename model-binding predicates that do not return values and replace omittable exists variables with don't-care expressions. --- .../lib/codeql/actions/ast/internal/Ast.qll | 77 +++++-------------- 1 file changed, 18 insertions(+), 59 deletions(-) diff --git a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll index 419d9d34e188..e71ad1dc5987 100644 --- a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll +++ b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll @@ -423,7 +423,7 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction { ) } - predicate getAnExternalCompositeActionModel( + predicate hasExternalCompositeActionModel( string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha, string local_path ) { @@ -433,24 +433,14 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction { } predicate isExternalCompositeAction() { - exists( - string owner, string repo, string action_path, string requested_ref, - string resolved_commit_sha, string local_path - | - this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, - resolved_commit_sha, local_path) - ) + this.hasExternalCompositeActionModel(_, _, _, _, _, _) or this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%") } string getResolvedPath() { - exists( - string owner, string repo, string action_path, string requested_ref, - string resolved_commit_sha, string local_path - | - this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, - resolved_commit_sha, local_path) and + exists(string owner, string repo, string action_path, string requested_ref | + this.hasExternalCompositeActionModel(owner, repo, action_path, requested_ref, _, _) and result = externalCompositeActionName(owner, repo, action_path) + "@" + requested_ref.trim() ) or @@ -580,7 +570,7 @@ class ReusableWorkflowImpl extends AstNodeImpl, WorkflowImpl { ) } - predicate getAnExternalReusableWorkflowModel( + predicate hasExternalReusableWorkflowModel( string owner, string repo, string workflow_path, string requested_ref, string resolved_commit_sha, string local_path ) { @@ -590,24 +580,14 @@ class ReusableWorkflowImpl extends AstNodeImpl, WorkflowImpl { } predicate isExternalReusableWorkflow() { - exists( - string owner, string repo, string workflow_path, string requested_ref, - string resolved_commit_sha, string local_path - | - this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, - resolved_commit_sha, local_path) - ) + this.hasExternalReusableWorkflowModel(_, _, _, _, _, _) or this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%") // root folder for external workflows and composite actions } string getResolvedPath() { - exists( - string owner, string repo, string workflow_path, string requested_ref, - string resolved_commit_sha, string local_path - | - this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, - resolved_commit_sha, local_path) and + exists(string owner, string repo, string workflow_path, string requested_ref | + this.hasExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, _, _) and result = owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() + "@" + requested_ref.trim() ) @@ -1448,12 +1428,8 @@ class UsesStepImpl extends StepImpl, UsesImpl { private predicate isLocalCall() { this.isWorkspaceLocalCall() or this.isSelfCall() } private predicate hasModeledExternalCallee() { - exists( - string owner, string repo, string action_path, string requested_ref, - string resolved_commit_sha, string local_path - | - externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha, - local_path) and + exists(string owner, string repo, string action_path, string requested_ref | + externalCompositeActionDataModel(owner, repo, action_path, requested_ref, _, _) and this.getCallee() = externalCompositeActionName(owner, repo, action_path) and this.getVersion() = requested_ref.trim() ) @@ -1466,26 +1442,16 @@ class UsesStepImpl extends StepImpl, UsesImpl { } private predicate hasModeledExternalEnclosingCompositeAction() { - exists( - CompositeActionImpl action, string owner, string repo, string action_path, - string requested_ref, string resolved_commit_sha, string local_path - | + exists(CompositeActionImpl action | action = this.getEnclosingCompositeAction() and - action - .getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, - resolved_commit_sha, local_path) + action.hasExternalCompositeActionModel(_, _, _, _, _, _) ) } private string getSelfCallableName() { - exists( - CompositeActionImpl action, string owner, string repo, string action_path, - string requested_ref, string resolved_commit_sha, string local_path - | + exists(CompositeActionImpl action, string owner, string repo, string requested_ref | action = this.getEnclosingCompositeAction() and - action - .getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref, - resolved_commit_sha, local_path) and + action.hasExternalCompositeActionModel(owner, repo, _, requested_ref, _, _) and result = externalCompositeActionName(owner, repo, this.getCallee().suffix(2)) + "@" + requested_ref.trim() @@ -1556,12 +1522,8 @@ class ExternalJobImpl extends JobImpl, UsesImpl { } private predicate hasModeledExternalCallee() { - exists( - string owner, string repo, string workflow_path, string requested_ref, - string resolved_commit_sha, string local_path - | - externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, - resolved_commit_sha, local_path) and + exists(string owner, string repo, string workflow_path, string requested_ref | + externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, _, _) and this.getCallee() = owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() and this.getVersion() = requested_ref.trim() ) @@ -1570,13 +1532,10 @@ class ExternalJobImpl extends JobImpl, UsesImpl { override string getCallableName() { this.isLocalCall() and exists( - ReusableWorkflowImpl enclosing_workflow, string owner, string repo, string workflow_path, - string requested_ref, string resolved_commit_sha, string local_path + ReusableWorkflowImpl enclosing_workflow, string owner, string repo, string requested_ref | enclosing_workflow = this.getEnclosingWorkflow() and - enclosing_workflow - .getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, - resolved_commit_sha, local_path) and + enclosing_workflow.hasExternalReusableWorkflowModel(owner, repo, _, requested_ref, _, _) and result = owner.trim() + "/" + repo.trim() + "/" + this.getCallee() + "@" + requested_ref.trim() ) From 658a06548763683dffa6e8bc81bed9000a9dc8fa Mon Sep 17 00:00:00 2001 From: JarLob Date: Fri, 31 Jul 2026 17:38:18 +0300 Subject: [PATCH 7/7] Document external Actions model helpers Add QLDoc for external workflow and composite-action model bindings, classifications, and callable-name resolution. --- actions/ql/lib/codeql/actions/ast/internal/Ast.qll | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll index e71ad1dc5987..3a308e88a7d7 100644 --- a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll +++ b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll @@ -423,6 +423,10 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction { ) } + /** + * Holds if this composite action is described by an external composite action model with the + * given repository, action, revision, and local path details. + */ predicate hasExternalCompositeActionModel( string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha, string local_path @@ -432,6 +436,7 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction { local_path.trim() = this.getLocation().getFile().getRelativePath() } + /** Holds if this composite action was downloaded from an external repository. */ predicate isExternalCompositeAction() { this.hasExternalCompositeActionModel(_, _, _, _, _, _) or @@ -570,6 +575,10 @@ class ReusableWorkflowImpl extends AstNodeImpl, WorkflowImpl { ) } + /** + * Holds if this reusable workflow is described by an external reusable workflow model with the + * given repository, workflow, revision, and local path details. + */ predicate hasExternalReusableWorkflowModel( string owner, string repo, string workflow_path, string requested_ref, string resolved_commit_sha, string local_path @@ -579,6 +588,7 @@ class ReusableWorkflowImpl extends AstNodeImpl, WorkflowImpl { local_path.trim() = this.getLocation().getFile().getRelativePath() } + /** Holds if this reusable workflow was downloaded from an external repository. */ predicate isExternalReusableWorkflow() { this.hasExternalReusableWorkflowModel(_, _, _, _, _, _) or @@ -1381,6 +1391,7 @@ class EnvImpl extends AstNodeImpl, TEnvNode { abstract class UsesImpl extends AstNodeImpl { abstract string getCallee(); + /** Gets the canonical name used to resolve this `uses` element to its callable target. */ abstract string getCallableName(); abstract ScalarValueImpl getCalleeNode();