Skip to content

Add actions.lock extraction #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anurag6569201 wants to merge 1 commit into
base: qa/agent-github-codeql/pr-16-22487/base
Choose a base branch
from
Open

Add actions.lock extraction #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion actions/extractor/tools/autobuild-impl.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ $DefaultPathFilters = @(
'include:.github/reusable_workflows/**/*.yml',
'include:.github/reusable_workflows/**/*.yaml',
'include:**/action.yml',
'include:**/action.yaml'
'include:**/action.yaml',
'include:**/actions.lock'

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

The change adds 'include:**/actions.lock' to the default path filters, meaning every repository scanned by CodeQL will now extract lockfiles.

Impact: The change adds 'include:**/actions.lock' to the default path filters, meaning every repository scanned by CodeQL will now extract lockfiles. If a repository has a large number of 'actions.lock' files (e.g., in a monorepo with many workflows), this could cause unbounded database growth and performance degradation during extraction.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

)

if ($null -ne $env:LGTM_INDEX_FILTERS) {
Expand Down
1 change: 1 addition & 0 deletions actions/extractor/tools/autobuild.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
include:.github/reusable_workflows/**/*.yaml
include:**/action.yml
include:**/action.yaml
include:**/actions.lock
END
)

Expand Down
3 changes: 2 additions & 1 deletion actions/extractor/tools/baseline-config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
".github/reusable_workflows/**/*.yml",
".github/reusable_workflows/**/*.yaml",
"**/action.yml",
"**/action.yaml"
"**/action.yaml",
"**/actions.lock"
]
}
4 changes: 4 additions & 0 deletions actions/ql/integration-tests/actions-lock/query/actions.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
import codeql.actions.Lock

from ActionsLock lock
select lock.getFile()
4 changes: 4 additions & 0 deletions actions/ql/integration-tests/actions-lock/query/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
name: codeql/actions-lock-integration-test
dependencies:
codeql/actions-all: "*"
warnOnImplicitThis: true
6 changes: 6 additions & 0 deletions actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
on: push
jobs:
test:
runs-on: ubuntu-latest
steps:
- run: echo test
19 changes: 19 additions & 0 deletions actions/ql/integration-tests/actions-lock/src/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.2'
workflows:
'.github/workflows/test.yml':
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
dependencies:
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · CRITICAL

The lockfile contains 'owner_id' and 'repo_id' fields that are extracted into the CodeQL database without any validation or sanitization.

Impact: The lockfile contains 'owner_id' and 'repo_id' fields that are extracted into the CodeQL database without any validation or sanitization. If an attacker can influence the contents of 'actions.lock' (e.g., via a pull request to a repository being scanned), they can inject arbitrary YAML that gets parsed and exposed to queries, creating a potential injection vector for downstream analysis.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
ref: 'v4.37.8'
commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
owner_id: 9919
repo_id: 259445878
4 changes: 4 additions & 0 deletions actions/ql/integration-tests/actions-lock/test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
def test_actions_lock(codeql, actions, javascript):
codeql.database.create(source_root="src", language="actions")
output = codeql.query.run("query/actions.ql", database="test-db", _capture=True)

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

The integration test 'test_actions_lock' asserts only that the string '"actions.lock"' appears in the output, which would pass even if the query returned zero results or errored si

Impact: The integration test 'test_actions_lock' asserts only that the string '"actions.lock"' appears in the output, which would pass even if the query returned zero results or errored silently. The test does not verify that the lockfile was actually extracted or that the 'ActionsLock' class correctly identifies the file.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

assert "actions.lock" in output
1 change: 1 addition & 0 deletions actions/ql/lib/actions.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
import codeql.actions.Ast
import codeql.actions.Lock
5 changes: 5 additions & 0 deletions actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
category: feature
---
* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
provides access to their YAML abstract syntax trees.
10 changes: 10 additions & 0 deletions actions/ql/lib/codeql/actions/Lock.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
/**
* Provides classes for working with GitHub Actions lockfiles.
*/

private import codeql.actions.ast.internal.Yaml

/** An `actions.lock` file. */

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

The 'ActionsLock' class extends 'YamlDocument' but provides no documentation on what fields are available, how to access 'workflows' vs 'dependencies', or what the 'version' field

Impact: The 'ActionsLock' class extends 'YamlDocument' but provides no documentation on what fields are available, how to access 'workflows' vs 'dependencies', or what the 'version' field means. A new contributor would have to reverse-engineer the YAML structure from test fixtures, which is exactly the kind of implicit knowledge this skill warns against.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

class ActionsLock extends YamlDocument {

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · CRITICAL

The 'ActionsLock' class matches ANY file with basename 'actions.lock' regardless of directory or project context.

Impact: The 'ActionsLock' class matches ANY file with basename 'actions.lock' regardless of directory or project context. A malicious or accidental 'actions.lock' in a subdirectory (e.g., a vendored dependency or test fixture) will be extracted and treated as authoritative lockfile data, potentially causing false positives in security queries that rely on lockfile integrity.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
}
6 changes: 6 additions & 0 deletions actions/ql/test/library-tests/actions-lock/.github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
on: push
jobs:
test:
runs-on: ubuntu-latest
steps:
- run: echo test
19 changes: 19 additions & 0 deletions actions/ql/test/library-tests/actions-lock/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.2'
workflows:
'.github/workflows/test.yml':
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
dependencies:
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
ref: 'v4.37.8'
commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
owner_id: 9919
repo_id: 259445878
1 change: 1 addition & 0 deletions actions/ql/test/library-tests/actions-lock/options
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
semmle-extractor-options: actions.lock
1 change: 1 addition & 0 deletions actions/ql/test/library-tests/actions-lock/test.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
| actions.lock:0:0:0:0 | actions.lock |
4 changes: 4 additions & 0 deletions actions/ql/test/library-tests/actions-lock/test.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
import codeql.actions.Lock

from ActionsLock lock
select lock.getFile()
3 changes: 3 additions & 0 deletions javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -404,6 +404,9 @@ private void setupFilters() {
patterns.add("**/*tsconfig*.json");
patterns.add("**/codeql-javascript-*.json");

// exclude lock files that are not explicitly included via `LGTM_INDEX_FILTERS`
patterns.add("-**/*.lock");

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · CRITICAL

The JavaScript extractor now excludes ALL '/*.lock' files via 'patterns.add("-/*.lock")', but the YAML extractor simultaneously adds '.lock' as a YAML extension.

Impact: The JavaScript extractor now excludes ALL '/*.lock' files via 'patterns.add("-/*.lock")', but the YAML extractor simultaneously adds '.lock' as a YAML extension. This creates a direct conflict: 'actions.lock' files will be excluded by the JS filter before the YAML extractor can process them, breaking the entire feature this PR claims to add. The integration test only tests the actions extractor, not the JavaScri…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.


// include any explicitly specified extensions
for (String extension : fileTypes.keySet()) patterns.add("**/*" + extension);

Expand Down
2 changes: 1 addition & 1 deletion javascript/extractor/src/com/semmle/js/extractor/FileExtractor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,7 +321,7 @@ public boolean isTrapCachingAllowed() {
}
},

YAML(".raml", ".yaml", ".yml") {
YAML(".lock", ".raml", ".yaml", ".yml") {
@Override
public IExtractor mkExtractor(ExtractorConfig config, ExtractorState state) {
return new YAMLExtractor(config);
Expand Down