Unpinned floating tags (e.g. `v4`) on immutable Actions are not flagged by `actions/unpinned-tag`

[redsun82]

Description of the issue

The actions/unpinned-tag query (actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql) exempts any Action on the immutable-actions allow list from the unpinned-tag warning, regardless of the ref used. The exclusion is version-independent:

not exists(UsesStep step | uses = step and isImmutableAction(step, nwo))

and isImmutableAction (actions/ql/lib/codeql/actions/security/UseOfUnversionedImmutableAction.qll) only checks membership in immutableActionsDataModel(nwo); it never inspects the version.

Why this is a gap

GitHub's immutability guarantee only applies to fully-expanded SemVer release tags (vX.Y.Z) and full commit SHAs. Floating tags such as v4, v4.0 and main remain mutable: maintainers move them to the latest matching release, so they can change under a consumer exactly like any other tag. See Using immutable releases and tags to manage your action's releases.

As a result, a reference like actions/checkout@v2 is flagged by neither query:

• UnpinnedActionsTag skips it because actions/checkout is on the immutable list.
• UnversionedImmutableAction skips it because its isSemVer predicate accepts a bare major tag like v2.

So a genuinely mutable floating tag on an immutable Action goes unwarned.

Suggested direction

Narrow the exemption so an immutable Action is only exempt when pinned to a full vX.Y.Z (or a SHA), for example:

not (isImmutableAction(step, nwo) and isFullSemVer(version))

with an isFullSemVer stricter than the current isSemVer (which also matches floating vX and vX.Y). This would need care because the immutable-action model is shared with the experimental UnversionedImmutableAction query, and it would increase alert volume for consumers pinning immutable Actions to floating major tags, so it deserves its own change note and review.

Filed as a follow-up to #22409 (which is scoped to the trusted-owner allow list and does not address this).

[redsun82]

Owner-overlap observation (why the gap is mostly invisible today):

The immutable-actions allow list currently spans three owners: actions, github, and octokit. The trusted-by-default owner list is actions, github, and advanced-security.

So all but one immutable entry are owned by an owner that is already trusted by default. For every actions/* and github/* entry, the immutable exemption is redundant with the trusted-owner exemption in UnpinnedActionsTag, so a floating tag like actions/checkout@v4 is skipped for two independent reasons and the gap is masked.

The one exception is octokit/request-action: octokit is not a trusted-by-default owner, so a floating octokit/request-action@v2 is skipped purely because it is immutable. That is the one spot where the gap is observable without any config changes.

This also sharpens the interaction with #22409: even after distrusting an owner via a !owner entry, the immutable exemption still overrides that distrust, so the immutable exemption (not owner trust) is the real gatekeeper for these entries. Tightening it via isFullSemVer is what actually closes the gap.