From 22c5ab2c265064cbf9b60069908bf8a2a77b5c83 Mon Sep 17 00:00:00 2001 From: JarLob Date: Tue, 4 Aug 2026 23:34:52 +0300 Subject: [PATCH] Remove SelfHostedQuery completely --- .../2026-08-03-deprecate-self-hosted-query.md | 4 -- ...-08-04-remove-self-hosted-query-library.md | 4 ++ .../actions/security/SelfHostedQuery.qll | 52 ------------------- 3 files changed, 4 insertions(+), 56 deletions(-) delete mode 100644 actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md create mode 100644 actions/ql/lib/change-notes/2026-08-04-remove-self-hosted-query-library.md delete mode 100644 actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll diff --git a/actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md b/actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md deleted file mode 100644 index 932a9e7ca49a..000000000000 --- a/actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: deprecated ---- -* The `codeql.actions.security.SelfHostedQuery` module has been deprecated because runner labels do not reliably distinguish self-hosted runners from managed runners. \ No newline at end of file diff --git a/actions/ql/lib/change-notes/2026-08-04-remove-self-hosted-query-library.md b/actions/ql/lib/change-notes/2026-08-04-remove-self-hosted-query-library.md new file mode 100644 index 000000000000..562b519e001a --- /dev/null +++ b/actions/ql/lib/change-notes/2026-08-04-remove-self-hosted-query-library.md @@ -0,0 +1,4 @@ +--- +category: breaking +--- +* The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted runners from managed runners. diff --git a/actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll b/actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll deleted file mode 100644 index b3f7bdaf24d3..000000000000 --- a/actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll +++ /dev/null @@ -1,52 +0,0 @@ -/** - * DEPRECATED: Runner labels do not reliably distinguish self-hosted runners from managed runners. - */ -deprecated module; - -import actions - -bindingset[runner] -predicate isGithubHostedRunner(string runner) { - // The list of github hosted repos: - // https://github.com/actions/runner-images/blob/main/README.md#available-images - // https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories - runner.toLowerCase().regexpMatch("^ubuntu-([0-9.]+|latest|slim)(-arm)?$") or - runner.toLowerCase().regexpMatch("^macos-([0-9]+|latest)(-x?large|-intel)?$") or - runner.toLowerCase().regexpMatch("^windows-([0-9.]+|latest)(-vs[0-9.]+)?(-arm)?$") -} - -bindingset[runner] -predicate is3rdPartyHostedRunner(string runner) { - runner.toLowerCase().regexpMatch("^(buildjet|warp)-[a-z0-9-]+$") -} - -/** - * This predicate uses data available in the workflow file to identify self-hosted runners. - * It does not know if the repository is public or private. - * It is a best-effort approach to identify self-hosted runners. - */ -predicate staticallyIdentifiedSelfHostedRunner(Job job) { - exists(string label | - job.getATriggerEvent().getName() = - [ - "issue_comment", "pull_request", "pull_request_review", "pull_request_review_comment", - "pull_request_target", "workflow_run" - ] and - label = job.getARunsOnLabel() and - not isGithubHostedRunner(label) and - not is3rdPartyHostedRunner(label) - ) -} - -/** - * This predicate uses data available in the job log files to identify self-hosted runners. - * It is a best-effort approach to identify self-hosted runners. - */ -predicate dynamicallyIdentifiedSelfHostedRunner(Job job) { - exists(string runner_info | - repositoryDataModel("public", _) and - workflowDataModel(job.getEnclosingWorkflow().getLocation().getFile().getRelativePath(), _, - job.getId(), _, _, runner_info) and - runner_info.indexOf("self-hosted:true") > 0 - ) -}