Actions: Add new models for external actions/workflows - #22263
Open
JarLob wants to merge 8 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds version-aware modeling and interprocedural analysis for downloaded external reusable workflows and composite actions.
Changes:
- Adds external workflow/action extension predicates and call resolution.
- Moves downloaded files under a collision-resistant UUID directory.
- Adds documentation, models, and regression tests.
Show a summary per file
| File | Description |
|---|---|
docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst |
Documents new predicates. |
actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected |
Updates expected external-workflow paths. |
actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml |
Adds reusable-workflow fixture. |
actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml |
Adds external workflow fixture. |
actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml |
Adds checkout fixture. |
actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested.yml |
Adds nested workflow fixture. |
actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml |
Adds branching workflow fixture. |
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected |
Updates medium-query results. |
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected |
Updates critical-query results. |
actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml |
Adds external action fixture. |
actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml |
Adds code-injection fixture. |
actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml |
Adds reusable-workflow fixture. |
actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml |
Adds composite-action fixture. |
actions/ql/test/qlpack.yml |
Loads external models in tests. |
actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql |
Tests workflow call resolution. |
actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected |
Records workflow resolution results. |
actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml |
Adds v2 callee fixture. |
actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml |
Adds v2 nested caller fixture. |
actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml |
Adds v1 callee fixture. |
actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml |
Adds v1 nested caller fixture. |
actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/ref-07cp61dt7qne3/.github/workflows/legacy.yml |
Adds unmodeled workflow fixture. |
actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml |
Tests unmodeled calls. |
actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml |
Tests versioned calls. |
actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql |
Tests action call resolution. |
actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected |
Records action resolution results. |
actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ref-0wu7t20oora8i/remote/action.yml |
Adds unmodeled action fixture. |
actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml |
Adds v2 external action. |
actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml |
Adds v1 external action. |
actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml |
Adds action caller workflow. |
actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml |
Adds local v2 root action. |
actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml |
Adds local v1 root action. |
actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml |
Adds local leaf action. |
actions/ql/test/external-reusable-workflows.model.yml |
Defines test download models. |
actions/ql/src/change-notes/2026-07-31-external-workflow-models.md |
Adds analysis change note. |
actions/ql/lib/ext/config/workflow_runtime_data.yml |
Registers extension schemas. |
actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll |
Uses resolved workflow callers. |
actions/ql/lib/codeql/actions/Helper.qll |
Removes legacy path exclusions. |
actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll |
Uses qualified callable names. |
actions/ql/lib/codeql/actions/config/ConfigExtensions.qll |
Declares new predicates. |
actions/ql/lib/codeql/actions/config/Config.qll |
Exposes extension data. |
actions/ql/lib/codeql/actions/ast/internal/Ast.qll |
Resolves modeled external calls. |
actions/extractor/tools/baseline-config.json |
Updates baseline extraction paths. |
actions/extractor/tools/autobuild.sh |
Updates Unix path filters. |
actions/extractor/tools/autobuild-impl.ps1 |
Updates Windows path filters. |
Review details
- Files reviewed: 35/44 changed files
- Comments generated: 2
- Review effort level: Balanced
Resolve $/ paths in downloaded reusable workflows and composite actions against their modeled repository, and cover both forms while retaining ./ compatibility.
Preserve both Actions test data extensions and regenerate the conflicting CWE-094 and CWE-829 expected results.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
Rename model-binding predicates that do not return values and replace omittable exists variables with don't-care expressions.
Add QLDoc for external workflow and composite-action model bindings, classifications, and callable-name resolution.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously it wasn't using extension predicates, just looking for downloaded workflow files in
.github/workflows/external/. It is used only internally, so imho the accidental rename in #18563 is safe to be edited.I used a random unique name
9466014afba34ef28239871ceabf4132where the downloaded external workflows/actions are stored, but I'm open for discussion. The name is visible in alerts, but using something asreusable_workflowsmay potentially run into the naming conflict.