Merge github/main into feature/actions-external-workflow-models

Preserve both Actions test data extensions and regenerate the conflicting CWE-094 and CWE-829 expected results.

Author: JarLob

MODULE.bazel

@@ -326,10 +326,11 @@ ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archi
 # go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
 ripunzip_archive(
     name = "ripunzip",
-    sha256_linux = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
-    sha256_macos_arm = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
-    sha256_macos_intel = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
-    sha256_windows = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
+    sha256_linux_arm64 = "a282740ef376ff8dc0de3c589b7457598db15cc045b7daa688f15531612e0bbe",
+    sha256_linux_x64 = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
+    sha256_macos_arm64 = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
+    sha256_macos_x64 = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
+    sha256_windows_x64 = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
     version = "2.0.4",
 )
 

actions/ql/lib/change-notes/2026-07-27-merge-group-event-source.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.

actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

@@ -151,7 +151,7 @@ Event getRelevantNonArtifactEventInPrivilegedContext(DataFlow::Node sink) {
 private module EnvVarInjectionConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
     source instanceof RemoteFlowSource and
-    not source.(RemoteFlowSource).getSourceType() = ["branch", "username"]
+    not source.(RemoteFlowSource).getSourceType() = ["branch", "label", "username"]
   }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof EnvVarInjectionSink }

actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll

@@ -111,6 +111,43 @@ class WorkflowCommandClobberingFromEnvVarSink extends OutputClobberingSink {
   }
 }
 
+private string jqSafeOptionRegexp() {
+  result = "-[acCMeRnSs]+"
+  or
+  result =
+    "--(ascii-output|color-output|compact-output|exit-status|monochrome-output|null-input|" +
+      "raw-input|slurp|sort-keys|unbuffered)"
+}
+
+private string jqSimpleFilterRegexp() {
+  result = "\\."
+  or
+  result = "\\.[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*|\\[[0-9]+\\])*"
+}
+
+private string jqSimpleFilterArgumentRegexp() {
+  result = jqSimpleFilterRegexp()
+  or
+  result = "'" + jqSimpleFilterRegexp() + "'"
+  or
+  result = "\"" + jqSimpleFilterRegexp() + "\""
+}
+
+private string jqLiteralInputRegexp() {
+  result = "[A-Za-z0-9_./][A-Za-z0-9_./-]*"
+  or
+  result = "\\$GITHUB_EVENT_PATH"
+  or
+  result = "\\$\\{GITHUB_EVENT_PATH\\}"
+}
+
+bindingset[command]
+private predicate jqProducesJsonEncodedOutput(string command) {
+  command
+      .regexpMatch("jq(\\s+" + jqSafeOptionRegexp() + ")*\\s+" + jqSimpleFilterArgumentRegexp() +
+          "(\\s+" + jqSafeOptionRegexp() + ")*(\\s+" + jqLiteralInputRegexp() + ")*")
+}
+
 /**
  *      - id: clob1
  *        run: |
@@ -159,13 +196,17 @@ class WorkflowCommandClobberingFromFileReadSink extends OutputClobberingSink {
         clobbering_cmd.regexpMatch(["ls", Bash::fileReadCommand()] + "\\s.*") and
         (
           // - run: echo "foo=$(<pr-id.txt)"
-          clobbering_stmt.regexpMatch("echo.*" + clobbering_cmd + ".*")
+          exists(string echo, int echoOffset |
+            echo = clobbering_stmt.regexpFind("\\becho\\s+", _, echoOffset) and
+            clobbering_stmt.indexOf(clobbering_cmd, 0, echoOffset + echo.length()) >= 0
+          )
           or
           // A file content is printed to stdout
           // - run: cat pr-id.txt
           clobbering_stmt.indexOf(clobbering_cmd) = 0
         )
-      )
+      ) and
+      not jqProducesJsonEncodedOutput(clobbering_cmd)
     )
   }
 }

actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll

@@ -382,3 +382,50 @@ class GhSHACheckout extends SHACheckoutStep instanceof Run {
 
   override string getPath() { result = this.(Run).getWorkingDirectory() }
 }
+
+private predicate isRunCheckoutReference(
+  PRHeadCheckoutStep checkout, Expression reference, string variable
+) {
+  reference = checkout.(Run).getInScopeEnvVarExpr(variable) and
+  (
+    checkout instanceof SHACheckoutStep and containsHeadSHA(reference.getExpression())
+    or
+    checkout instanceof MutableRefCheckoutStep and
+    (
+      containsHeadRef(reference.getExpression()) or
+      containsPullRequestNumber(reference.getExpression())
+    )
+  ) and
+  exists(string command |
+    checkout.(Run).getScript().getACommand() = command and
+    exists(command.regexpFind(variable, _, _))
+  )
+}
+
+/** Gets the expression that controls the untrusted checkout, if one can be identified. */
+AstNode getCheckoutReference(PRHeadCheckoutStep checkout) {
+  exists(UsesStep uses | uses = checkout |
+    result = uses.getArgumentExpr("ref")
+    or
+    not exists(uses.getArgumentExpr("ref")) and result = uses.getArgumentExpr("repository")
+  )
+  or
+  isRunCheckoutReference(checkout, result, _)
+  or
+  checkout instanceof Run and
+  result = checkout and
+  not isRunCheckoutReference(checkout, _, _)
+}
+
+/** Gets a display label for the expression that controls the untrusted checkout. */
+string getCheckoutReferenceText(AstNode reference) {
+  result = reference.(Expression).toString()
+  or
+  not reference instanceof Expression and result = "the checkout command"
+}
+
+/** Adds checkout-reference provenance before the checkout step in path queries. */
+predicate checkoutReferenceEdge(AstNode predecessor, AstNode successor) {
+  predecessor = getCheckoutReference(successor) and
+  not predecessor = successor
+}

actions/ql/lib/ext/config/context_event_map.yml

@@ -19,6 +19,7 @@ extensions:
       - ["gollum", "github.event.changes"] 
       - ["pull_request_comment", "github.event.comment"] 
       - ["pull_request_comment", "github.event.pull_request"] 
+      - ["merge_group", "github.event.merge_group"]
       - ["pull_request_comment", "github.head_ref"] 
       - ["pull_request_comment", "github.event.changes"] 
       - ["pull_request_review", "github.event.pull_request"] 

actions/ql/lib/ext/config/externally_triggereable_events.yml

@@ -17,4 +17,4 @@ extensions:
       - ["workflow_run"] # depending on branch filter
       - ["workflow_call"] # depending on caller
       - ["workflow_dispatch"] 
-      - ["scheduled"]
+      - ["schedule"]

actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql

@@ -19,9 +19,16 @@ import codeql.actions.dataflow.FlowSources
 import EnvVarInjectionFlow::PathGraph
 import codeql.actions.security.ControlChecks
 
+bindingset[source, event]
+pragma[inline_late]
+private predicate hasSameEventName(RemoteFlowSource source, Event event) {
+  source.getEventName() = event.getName()
+}
+
 from EnvVarInjectionFlow::PathNode source, EnvVarInjectionFlow::PathNode sink, Event event
 where
   EnvVarInjectionFlow::flowPath(source, sink) and
+  hasSameEventName(source.getNode(), event) and
   // exclude paths to file read sinks from non-artifact sources
   (
     // source is text

actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql

@@ -18,20 +18,30 @@ import codeql.actions.security.CachePoisoningQuery
 import codeql.actions.security.PoisonableSteps
 import codeql.actions.security.ControlChecks
 
-query predicate edges(Step a, Step b) { a.getNextStep() = b }
+query predicate edges(AstNode predecessor, AstNode successor) {
+  predecessor.(Step).getNextStep() = successor
+  or
+  checkoutReferenceEdge(predecessor, successor)
+}
 
-from LocalJob job, Event event, Step source, Step step, string message, string path
+from
+  LocalJob job, Event event, Step source, Step step, string message, string path,
+  AstNode untrustedInput, string untrustedInputText
 where
   // the job checkouts untrusted code from a pull request or downloads an untrusted artifact
   job.getAStep() = source and
   (
     source instanceof PRHeadCheckoutStep and
-    message = "due to privilege checkout of untrusted code." and
-    path = source.(PRHeadCheckoutStep).getPath()
+    message = "due to privilege checkout of untrusted code from" and
+    path = source.(PRHeadCheckoutStep).getPath() and
+    untrustedInput = getCheckoutReference(source) and
+    untrustedInputText = getCheckoutReferenceText(untrustedInput)
     or
     source instanceof UntrustedArtifactDownloadStep and
-    message = "due to downloading an untrusted artifact." and
-    path = source.(UntrustedArtifactDownloadStep).getPath()
+    message = "due to downloading" and
+    path = source.(UntrustedArtifactDownloadStep).getPath() and
+    untrustedInput = source and
+    untrustedInputText = "an untrusted artifact"
   ) and
   // the checkout/download is not controlled by an access check
   not exists(ControlCheck check |
@@ -57,6 +67,6 @@ where
   step instanceof PoisonableStep and
   // excluding privileged workflows since they can be exploited in easier circumstances
   not job.isPrivileged()
-select step, source, step,
-  "Potential cache poisoning in the context of the default branch " + message + " ($@).", event,
-  event.getName()
+select step, untrustedInput, step,
+  "Potential cache poisoning in the context of the default branch " + message + " $@. ($@).",
+  untrustedInput, untrustedInputText, event, event.getName()

actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql

@@ -18,10 +18,18 @@ import codeql.actions.security.UntrustedCheckoutQuery
 import codeql.actions.security.PoisonableSteps
 import codeql.actions.security.ControlChecks
 
-query predicate edges(Step a, Step b) { a.getNextStep() = b }
+query predicate edges(AstNode predecessor, AstNode successor) {
+  predecessor.(Step).getNextStep() = successor
+  or
+  checkoutReferenceEdge(predecessor, successor)
+}
 
-from PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event
+from
+  PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event, AstNode checkoutReference,
+  string checkoutReferenceText
 where
+  checkoutReference = getCheckoutReference(checkout) and
+  checkoutReferenceText = getCheckoutReferenceText(checkoutReference) and
   // the checkout is followed by a known poisonable step
   checkout.getAFollowingStep() = poisonable and
   (
@@ -51,6 +59,6 @@ where
   event.getName() = checkoutTriggers() and
   not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout")) and
   not exists(ControlCheck check | check.protects(poisonable, event, "untrusted-checkout"))
-select checkout, checkout, poisonable,
-  "Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@).",
-  event, event.getName()
+select checkout, checkoutReference, poisonable,
+  "Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@).",
+  checkoutReference, checkoutReferenceText, event, event.getName()