diff --git a/actions/ql/integration-tests/query-suite/not_included_in_qls.expected b/actions/ql/integration-tests/query-suite/not_included_in_qls.expected index 6ed0a557462b..da088b688131 100644 --- a/actions/ql/integration-tests/query-suite/not_included_in_qls.expected +++ b/actions/ql/integration-tests/query-suite/not_included_in_qls.expected @@ -11,7 +11,6 @@ ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql ql/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql -ql/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql ql/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql ql/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql ql/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql diff --git a/actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md b/actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md new file mode 100644 index 000000000000..932a9e7ca49a --- /dev/null +++ b/actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md @@ -0,0 +1,4 @@ +--- +category: deprecated +--- +* The `codeql.actions.security.SelfHostedQuery` module has been deprecated because runner labels do not reliably distinguish self-hosted runners from managed runners. \ No newline at end of file diff --git a/actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll b/actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll index 3a65771c1745..b3f7bdaf24d3 100644 --- a/actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll +++ b/actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll @@ -1,3 +1,8 @@ +/** + * DEPRECATED: Runner labels do not reliably distinguish self-hosted runners from managed runners. + */ +deprecated module; + import actions bindingset[runner] diff --git a/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql b/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql deleted file mode 100644 index 9610302d1c2a..000000000000 --- a/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql +++ /dev/null @@ -1,19 +0,0 @@ -/** - * @name Pull Request code execution on self-hosted runner - * @description Running untrusted code on a public repository's self-hosted runner can lead to the compromise of the runner machine - * @kind problem - * @problem.severity error - * @security-severity 9.0 - * @precision high - * @id actions/pr-on-self-hosted-runner - * @tags actions - * security - * experimental - * external/cwe/cwe-284 - */ - -import codeql.actions.security.SelfHostedQuery - -from Job job -where staticallyIdentifiedSelfHostedRunner(job) or dynamicallyIdentifiedSelfHostedRunner(job) -select job, "Job runs on self-hosted runner" diff --git a/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test1.yml b/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test1.yml deleted file mode 100644 index 37eb2bddb58c..000000000000 --- a/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test1.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: test - -on: - pull_request: - -jobs: - test1: - runs-on: [self-hosted, X64, Linux, 16c32g] - steps: - - run: cmd - test2: - runs-on: - group: my-group - labels: [self-hosted, label-1] - steps: - - run: cmd - test3: - runs-on: - - 'self-hosted' - - 'linux' - - 'x64' - - 'metal' - steps: - - run: echo "foo" - test4: - runs-on: self-hosted-azure - steps: - - run: cmd - test5: - strategy: - fail-fast: false - matrix: - platform: - - name: Linux - os: ubuntu-latest - shell: bash - - name: macOS - os: macos-latest - shell: bash - - name: Windows - os: windows-latest - shell: cmd - node-version: - - 16.14.0 - - 16.x - - 18.0.0 - - 18.x - - 20.x - runs-on: ${{ matrix.platform.os }} - steps: - - run: cmd - test6: - strategy: - matrix: - os: [ubuntu-latest, macos-latest] - runs-on: ${{ matrix.os }} - steps: - - run: cmd - test7: - strategy: - matrix: - os: [self-hosted, ubuntu-latest] - runs-on: ${{ matrix.os }} - steps: - - run: cmd - test8: - strategy: - matrix: - settings: - - host: - - 'self-hosted' - - 'macos' - - 'arm64' - target: 'x86_64-apple-darwin' - runs-on: ${{ matrix.settings.host }} - steps: - - run: cmd - test9: - strategy: - matrix: - os: ${{ github.repository }} - runs-on: ${{ matrix.os }} - steps: - - run: cmd - test10: - strategy: - matrix: - os: ${{ github.repository }} - foo: - - bar: ${{ github.repository }} - baz: "asdf" - runs-on: ${{ matrix.foo.bar }} - steps: - - run: cmd diff --git a/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test2.yml b/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test2.yml deleted file mode 100644 index 243bac925994..000000000000 --- a/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test2.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: test - -on: - push: - -jobs: - test1: - runs-on: [self-hosted, foo] - steps: - - run: cmd - test2: - runs-on: - group: my-group - labels: [self-hosted, foo] - steps: - - run: cmd - test3: - runs-on: - - 'self-hosted' - - 'foo' - steps: - - run: cmd - test4: - runs-on: self-hosted-azure - steps: - - run: cmd diff --git a/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test3.yml b/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test3.yml deleted file mode 100644 index b1fe9fa0caa6..000000000000 --- a/actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test3.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: test - -on: - pull_request: - -jobs: - test: - strategy: - fail-fast: false - matrix: - os: - - ubuntu-latest - - ubuntu-24.04 - - ubuntu-24.04-arm - - ubuntu-22.04 - - ubuntu-22.04-arm - - ubuntu-26.04 - - ubuntu-26.04-arm - - ubuntu-slim - - macos-26 - - macos-26-xlarge - - macos-26-intel - - macos-26-large - - macos-latest-large - - macos-15-large - - macos-15 - - macos-15-intel - - macos-latest - - macos-15 - - macos-15-xlarge - - macos-14-large - - macos-14 - - macos-14-xlarge - - windows-2025-vs2026 - - windows-latest - - windows-2025 - - windows-2022 - - windows-11 - - windows-11-arm - - windows-11-vs2026-arm - runs-on: ${{ matrix.os }} - steps: - - run: cmd diff --git a/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.expected b/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.expected deleted file mode 100644 index 306bed9baec1..000000000000 --- a/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.expected +++ /dev/null @@ -1,8 +0,0 @@ -| .github/workflows/test1.yml:8:5:11:2 | Job: test1 | Job runs on self-hosted runner | -| .github/workflows/test1.yml:12:5:17:2 | Job: test2 | Job runs on self-hosted runner | -| .github/workflows/test1.yml:18:5:25:2 | Job: test3 | Job runs on self-hosted runner | -| .github/workflows/test1.yml:26:5:29:2 | Job: test4 | Job runs on self-hosted runner | -| .github/workflows/test1.yml:60:5:66:2 | Job: test7 | Job runs on self-hosted runner | -| .github/workflows/test1.yml:67:5:78:2 | Job: test8 | Job runs on self-hosted runner | -| .github/workflows/test1.yml:79:5:85:2 | Job: test9 | Job runs on self-hosted runner | -| .github/workflows/test1.yml:86:5:94:15 | Job: test10 | Job runs on self-hosted runner | diff --git a/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref b/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref deleted file mode 100644 index dc99068b3035..000000000000 --- a/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref +++ /dev/null @@ -1,2 +0,0 @@ -experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql -