Skip to content

Actions: Add four experimental queries #21624

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JamieMagee wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Actions: Add four experimental queries #21624

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
58240fb
Actions: Add four experimental queries inspired by Zizmor
JamieMagee Mar 31, 2026
ba80186
Fix redundant casts and clarify actor-check wording
JamieMagee Apr 1, 2026
0d18758
Add new experimental queries to not_included_in_qls.expected
JamieMagee Apr 1, 2026
0f515fa
Fix ql-format for HardcodedContainerCredentials
JamieMagee Apr 1, 2026
78c3aba
Address Copilot review: fix ref wording, add service secrets negative…
JamieMagee Apr 1, 2026
b71f88a
secrets-inherit: soften to best-practice recommendation
JamieMagee Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix ql-format for HardcodedContainerCredentials
  • Loading branch information
@JamieMagee
JamieMagee committed Apr 2, 2026
commit 0f515fa6f02ea014f023bec5e561d39f328b4e22
3 changes: 1 addition & 2 deletions actions/ql/src/experimental/Security/CWE-798/HardcodedContainerCredentials.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,7 @@ private import codeql.actions.ast.internal.Ast
YamlScalar getAHardcodedPassword(LocalJobImpl job, string context) {
exists(YamlMapping creds |
// Job-level container credentials
creds =
job.getNode().lookup("container").(YamlMapping).lookup("credentials") and
creds = job.getNode().lookup("container").(YamlMapping).lookup("credentials") and
context = "container"
or
// Service-level container credentials
Expand Down