Skip to content

Commit c5844ad

Browse files
knewbury01knewbury01
authored
Merge branch 'main' into knewbury01/adjust-environmentcheck
2 parents 2cd9220 + 5690ec7 commit c5844ad

4,343 files changed

Lines changed: 162966 additions & 46246 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/go-version-update.yml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
name: Update Go version
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 3 * * 1" # Run weekly on Mondays at 3 AM UTC (1 = Monday)
7+
8+
permissions:
9+
contents: write
10+
pull-requests: write
11+
12+
jobs:
13+
update-go-version:
14+
name: Check and update Go version
15+
if: github.repository == 'github/codeql'
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v5
21+
with:
22+
fetch-depth: 0
23+
24+
- name: Set up Git
25+
run: |
26+
git config user.name "github-actions[bot]"
27+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
28+
29+
- name: Fetch latest Go version
30+
id: fetch-version
31+
run: |
32+
LATEST_GO_VERSION=$(curl -s https://go.dev/dl/?mode=json | jq -r '.[0].version')
33+
34+
if [ -z "$LATEST_GO_VERSION" ] || [ "$LATEST_GO_VERSION" = "null" ]; then
35+
echo "Error: Failed to fetch latest Go version from go.dev"
36+
exit 1
37+
fi
38+
39+
echo "Latest Go version from go.dev: $LATEST_GO_VERSION"
40+
echo "version=$LATEST_GO_VERSION" >> $GITHUB_OUTPUT
41+
42+
# Extract version numbers (e.g., go1.26.0 -> 1.26.0)
43+
LATEST_VERSION_NUM=$(echo $LATEST_GO_VERSION | sed 's/^go//')
44+
echo "version_num=$LATEST_VERSION_NUM" >> $GITHUB_OUTPUT
45+
46+
# Extract major.minor version (e.g., 1.26.0 -> 1.26)
47+
LATEST_MAJOR_MINOR=$(echo $LATEST_VERSION_NUM | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
48+
echo "major_minor=$LATEST_MAJOR_MINOR" >> $GITHUB_OUTPUT
49+
50+
- name: Check current Go version
51+
id: current-version
52+
run: |
53+
CURRENT_VERSION=$(sed -n 's/.*go_sdk\.download(version = \"\([^\"]*\)\".*/\1/p' MODULE.bazel)
54+
55+
if [ -z "$CURRENT_VERSION" ]; then
56+
echo "Error: Could not extract Go version from MODULE.bazel"
57+
exit 1
58+
fi
59+
60+
echo "Current Go version in MODULE.bazel: $CURRENT_VERSION"
61+
echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
62+
63+
# Extract major.minor version
64+
CURRENT_MAJOR_MINOR=$(echo $CURRENT_VERSION | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
65+
echo "major_minor=$CURRENT_MAJOR_MINOR" >> $GITHUB_OUTPUT
66+
67+
- name: Compare versions
68+
id: compare
69+
run: |
70+
LATEST="${{ steps.fetch-version.outputs.version_num }}"
71+
CURRENT="${{ steps.current-version.outputs.version }}"
72+
73+
echo "Latest: $LATEST"
74+
echo "Current: $CURRENT"
75+
76+
if [ "$LATEST" = "$CURRENT" ]; then
77+
echo "Go version is up to date"
78+
echo "needs_update=false" >> $GITHUB_OUTPUT
79+
else
80+
echo "Go version needs update from $CURRENT to $LATEST"
81+
echo "needs_update=true" >> $GITHUB_OUTPUT
82+
fi
83+
84+
- name: Update Go version in files
85+
if: steps.compare.outputs.needs_update == 'true'
86+
run: |
87+
LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
88+
LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
89+
CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
90+
CURRENT_MAJOR_MINOR="${{ steps.current-version.outputs.major_minor }}"
91+
92+
echo "Updating from $CURRENT_VERSION to $LATEST_VERSION_NUM"
93+
94+
# Escape dots in current version strings for use in sed patterns
95+
CURRENT_VERSION_ESCAPED=$(echo "$CURRENT_VERSION" | sed 's/\./\\./g')
96+
CURRENT_MAJOR_MINOR_ESCAPED=$(echo "$CURRENT_MAJOR_MINOR" | sed 's/\./\\./g')
97+
98+
# Update MODULE.bazel
99+
sed -i "s/go_sdk\.download(version = \"$CURRENT_VERSION_ESCAPED\")/go_sdk.download(version = \"$LATEST_VERSION_NUM\")/" MODULE.bazel
100+
if ! grep -q "go_sdk.download(version = \"$LATEST_VERSION_NUM\")" MODULE.bazel; then
101+
echo "Error: Failed to update MODULE.bazel"
102+
exit 1
103+
fi
104+
105+
# Update go/extractor/go.mod
106+
if ! sed -i "s/^go $CURRENT_MAJOR_MINOR_ESCAPED\$/go $LATEST_MAJOR_MINOR/" go/extractor/go.mod; then
107+
echo "Warning: Failed to update go directive in go.mod"
108+
fi
109+
if ! sed -i "s/^toolchain go$CURRENT_VERSION_ESCAPED\$/toolchain go$LATEST_VERSION_NUM/" go/extractor/go.mod; then
110+
echo "Warning: Failed to update toolchain in go.mod"
111+
fi
112+
113+
# Update go/extractor/autobuilder/build-environment.go
114+
if ! sed -i "s/var maxGoVersion = util\.NewSemVer(\"$CURRENT_MAJOR_MINOR_ESCAPED\")/var maxGoVersion = util.NewSemVer(\"$LATEST_MAJOR_MINOR\")/" go/extractor/autobuilder/build-environment.go; then
115+
echo "Warning: Failed to update build-environment.go"
116+
fi
117+
118+
# Update go/actions/test/action.yml
119+
if ! sed -i "s/default: \"~$CURRENT_VERSION_ESCAPED\"/default: \"~$LATEST_VERSION_NUM\"/" go/actions/test/action.yml; then
120+
echo "Warning: Failed to update action.yml"
121+
fi
122+
123+
# Show what changed
124+
git diff
125+
126+
- name: Check for changes
127+
id: check-changes
128+
if: steps.compare.outputs.needs_update == 'true'
129+
run: |
130+
if git diff --quiet; then
131+
echo "No changes detected"
132+
echo "has_changes=false" >> $GITHUB_OUTPUT
133+
else
134+
echo "Changes detected"
135+
echo "has_changes=true" >> $GITHUB_OUTPUT
136+
fi
137+
138+
- name: Check for existing PR
139+
if: steps.check-changes.outputs.has_changes == 'true'
140+
id: check-pr
141+
env:
142+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
143+
run: |
144+
BRANCH_NAME="workflow/go-version-update"
145+
PR_NUMBER=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number')
146+
147+
if [ -n "$PR_NUMBER" ]; then
148+
echo "Existing PR found: #$PR_NUMBER"
149+
echo "pr_exists=true" >> $GITHUB_OUTPUT
150+
echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
151+
else
152+
echo "No existing PR found"
153+
echo "pr_exists=false" >> $GITHUB_OUTPUT
154+
fi
155+
156+
- name: Commit and push changes
157+
if: steps.check-changes.outputs.has_changes == 'true'
158+
run: |
159+
BRANCH_NAME="workflow/go-version-update"
160+
LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
161+
LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
162+
163+
# Create or switch to branch
164+
git checkout -B "$BRANCH_NAME"
165+
166+
# Stage and commit changes
167+
git add MODULE.bazel go/extractor/go.mod go/extractor/autobuilder/build-environment.go go/actions/test/action.yml
168+
git commit -m "Go: Update to $LATEST_VERSION_NUM"
169+
170+
# Push changes
171+
git push --force-with-lease origin "$BRANCH_NAME"
172+
173+
- name: Create or update PR
174+
if: steps.check-changes.outputs.has_changes == 'true'
175+
env:
176+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
177+
run: |
178+
BRANCH_NAME="workflow/go-version-update"
179+
LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
180+
CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
181+
182+
PR_TITLE="Go: Update to $LATEST_VERSION_NUM"
183+
184+
PR_BODY=$(cat <<EOF
185+
This PR updates Go from $CURRENT_VERSION to $LATEST_VERSION_NUM.
186+
187+
Updated files:
188+
- \`MODULE.bazel\` - go_sdk.download version
189+
- \`go/extractor/go.mod\` - go directive and toolchain
190+
- \`go/extractor/autobuilder/build-environment.go\` - maxGoVersion (only if MAJOR.MINOR changes)
191+
- \`go/actions/test/action.yml\` - default go-test-version
192+
193+
This PR was automatically created by the [Go version update workflow](https://github.com/${{ github.repository }}/blob/main/.github/workflows/go-version-update.yml).
194+
EOF
195+
)
196+
197+
if [ "${{ steps.check-pr.outputs.pr_exists }}" = "true" ]; then
198+
echo "Updating existing PR #${{ steps.check-pr.outputs.pr_number }}"
199+
gh pr edit "${{ steps.check-pr.outputs.pr_number }}" --title "$PR_TITLE" --body "$PR_BODY"
200+
else
201+
echo "Creating new PR"
202+
gh pr create \
203+
--title "$PR_TITLE" \
204+
--body "$PR_BODY" \
205+
--base main \
206+
--head "$BRANCH_NAME" \
207+
--label "Go"
208+
fi

‎CODEOWNERS‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @github/code-scanning-alert-coverage
33

44
# CodeQL language libraries
5-
/actions/ @github/codeql-dynamic
5+
/actions/ @github/code-scanning-alert-coverage
66
/cpp/ @github/codeql-c-analysis
77
/csharp/ @github/codeql-csharp
88
/csharp/autobuilder/Semmle.Autobuild.Cpp @github/codeql-c-extractor @github/code-scanning-language-coverage
@@ -59,9 +59,5 @@ MODULE.bazel @github/codeql-ci-reviewers
5959
/.github/workflows/rust.yml @github/codeql-rust
6060
/.github/workflows/swift.yml @github/codeql-swift
6161

62-
# Misc
63-
/misc/scripts/accept-expected-changes-from-ci.py @RasmusWL
64-
/misc/scripts/generate-code-scanning-query-list.py @RasmusWL
65-
6662
# .devcontainer
6763
/.devcontainer/ @github/codeql-ci-reviewers

‎Cargo.lock‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ members = [
66
"shared/tree-sitter-extractor",
77
"shared/yeast",
88
"shared/yeast-macros",
9+
"shared/yeast-schema",
910
"ruby/extractor",
1011
"unified/extractor",
1112
"unified/extractor/tree-sitter-swift",

‎MODULE.bazel‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ bazel_dep(name = "rules_python", version = "1.9.0")
2424
bazel_dep(name = "rules_shell", version = "0.7.1")
2525
bazel_dep(name = "bazel_skylib", version = "1.9.0")
2626
bazel_dep(name = "abseil-cpp", version = "20260107.1", repo_name = "absl")
27-
bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
27+
bazel_dep(name = "nlohmann_json", version = "3.12.0.bcr.1", repo_name = "json")
2828
bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
2929
bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")
3030
bazel_dep(name = "gazelle", version = "0.50.0")
@@ -248,6 +248,7 @@ use_repo(
248248
"kotlin-compiler-2.2.20-Beta2",
249249
"kotlin-compiler-2.3.0",
250250
"kotlin-compiler-2.3.20",
251+
"kotlin-compiler-2.4.0",
251252
"kotlin-compiler-embeddable-1.8.0",
252253
"kotlin-compiler-embeddable-1.9.0-Beta",
253254
"kotlin-compiler-embeddable-1.9.20-Beta",
@@ -259,6 +260,7 @@ use_repo(
259260
"kotlin-compiler-embeddable-2.2.20-Beta2",
260261
"kotlin-compiler-embeddable-2.3.0",
261262
"kotlin-compiler-embeddable-2.3.20",
263+
"kotlin-compiler-embeddable-2.4.0",
262264
"kotlin-stdlib-1.8.0",
263265
"kotlin-stdlib-1.9.0-Beta",
264266
"kotlin-stdlib-1.9.20-Beta",
@@ -270,10 +272,11 @@ use_repo(
270272
"kotlin-stdlib-2.2.20-Beta2",
271273
"kotlin-stdlib-2.3.0",
272274
"kotlin-stdlib-2.3.20",
275+
"kotlin-stdlib-2.4.0",
273276
)
274277

275278
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
276-
go_sdk.download(version = "1.26.0")
279+
go_sdk.download(version = "1.26.5")
277280

278281
go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
279282
go_deps.from_file(go_mod = "//go/extractor:go.mod")

‎actions/ql/examples/snippets/uses_pinned_sha.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,5 @@
88
import actions
99

1010
from UsesStep uses
11-
where uses.getVersion().regexpMatch("^[A-Fa-f0-9]{40}$")
11+
where uses.getVersion().regexpMatch("^[A-Fa-f0-9]{40}([A-Fa-f0-9]{24})?$")
1212
select uses, "This 'uses' step has a pinned SHA version."

‎actions/ql/lib/CHANGELOG.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,26 @@
1+
## 0.4.39
2+
3+
No user-facing changes.
4+
5+
## 0.4.38
6+
7+
### Bug Fixes
8+
9+
* GitHub Actions queries now better account for permission checks on jobs that call reusable workflows.
10+
* The query `actions/pr-on-self-hosted-runner` was updated to the latest standard runner labels reducing false positive results.
11+
12+
## 0.4.37
13+
14+
### Minor Analysis Improvements
15+
16+
* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, including regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a SHA-1 or SHA-256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.
17+
18+
## 0.4.36
19+
20+
### Minor Analysis Improvements
21+
22+
* Altered 2 patterns in the `poisonable_steps` modelling. Extra sinks are detected in the following cases: scripts executed via python modules and `go run` in directories are detected as potential mechanisms of injection. For the go execution pattern, the pattern is updated to now ignore flags that occur between go and the specific command. This change may lead to more results being detected by the following queries: `actions/untrusted-checkout/high`, `actions/untrusted-checkout/critical`, `actions/untrusted-checkout-toctou/high`, `actions/untrusted-checkout-toctou/critical`, `actions/cache-poisoning/poisonable-step`, `actions/cache-poisoning/direct-cache` and `actions/artifact-poisoning/path-traversal`.
23+
124
## 0.4.35
225

326
No user-facing changes.

actions/ql/lib/change-notes/2026-04-15-poisonable-steps-additions-alterations.md renamed to actions/ql/lib/change-notes/released/0.4.36.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
---
2-
category: minorAnalysis
3-
---
4-
* Altered 2 patterns in the `poisonable_steps` modelling. Extra sinks are detected in the following cases: scripts executed via python modules and `go run` in directories are detected as potential mechanisms of injection. For the go execution pattern, the pattern is updated to now ignore flags that occur between go and the specific command. This change may lead to more results being detected by the following queries: `actions/untrusted-checkout/high`, `actions/untrusted-checkout/critical`, `actions/untrusted-checkout-toctou/high`, `actions/untrusted-checkout-toctou/critical`, `actions/cache-poisoning/poisonable-step`, `actions/cache-poisoning/direct-cache` and `actions/artifact-poisoning/path-traversal`.
1+
## 0.4.36
2+
3+
### Minor Analysis Improvements
4+
5+
* Altered 2 patterns in the `poisonable_steps` modelling. Extra sinks are detected in the following cases: scripts executed via python modules and `go run` in directories are detected as potential mechanisms of injection. For the go execution pattern, the pattern is updated to now ignore flags that occur between go and the specific command. This change may lead to more results being detected by the following queries: `actions/untrusted-checkout/high`, `actions/untrusted-checkout/critical`, `actions/untrusted-checkout-toctou/high`, `actions/untrusted-checkout-toctou/critical`, `actions/cache-poisoning/poisonable-step`, `actions/cache-poisoning/direct-cache` and `actions/artifact-poisoning/path-traversal`.

‎actions/ql/lib/change-notes/released/0.4.37.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## 0.4.37
2+
3+
### Minor Analysis Improvements
4+
5+
* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, including regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a SHA-1 or SHA-256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.

‎actions/ql/lib/change-notes/released/0.4.38.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
## 0.4.38
2+
3+
### Bug Fixes
4+
5+
* GitHub Actions queries now better account for permission checks on jobs that call reusable workflows.
6+
* The query `actions/pr-on-self-hosted-runner` was updated to the latest standard runner labels reducing false positive results.

0 commit comments

Comments
 (0)