Correct query metadata for actions/untrusted-checkout/medium#21946
Open
henrymercer wants to merge 1 commit into
Open
Correct query metadata for actions/untrusted-checkout/medium#21946henrymercer wants to merge 1 commit into
actions/untrusted-checkout/medium#21946henrymercer wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the actions/untrusted-checkout/medium query metadata (name/description/message) so it correctly describes detection in unprivileged workflow contexts, and updates the associated test expectations and change notes.
Changes:
- Adjusted
actions/untrusted-checkout/mediumquery metadata and alert message to refer to unprivileged workflows/contexts. - Renamed the helper predicate from
inNonPrivilegedContexttoinUnprivilegedContext. - Added a change note entry and updated the
.expectedtest output accordingly.
Show a summary per file
| File | Description |
|---|---|
| actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.expected | Updates expected test output to match the revised alert message text. |
| actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql | Updates query metadata text and switches to inUnprivilegedContext + updated message string. |
| actions/ql/src/change-notes/2026-06-04-untrusted-checkout-medium-metadata.md | Adds a change note documenting the query metadata correction. |
| actions/ql/lib/codeql/actions/Helper.qll | Renames the helper predicate used to detect unprivileged contexts. |
Copilot's findings
- Files reviewed: 4/4 changed files
- Comments generated: 2
9929cb5 to
2bf3faa
Compare
2bf3faa to
f4dc86e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Quick PR addressing some feedback from the 2.25.6 release. In particular, the
mediumseverityactions/untrusted-checkout/mediumquery only includes unprivileged contexts, so this PR updates its name, description, and message accordingly.