CHANGELOG.md

0.6.26

Major Analysis Improvements

• Fixed alert messages in actions/artifact-poisoning/critical and actions/artifact-poisoning/medium as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also improved the wording to make it clearer that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed. Finally, changed the alert location to be the source, to align more with other queries reporting an artifact (e.g. zipslip) which is more useful.

Minor Analysis Improvements

• The query actions/missing-workflow-permissions no longer produces false positive results on reusable workflows where all callers set permissions.

0.6.25

No user-facing changes.

0.6.24

No user-facing changes.

0.6.23

No user-facing changes.

0.6.22

No user-facing changes.

0.6.21

No user-facing changes.

0.6.20

No user-facing changes.

0.6.19

No user-facing changes.

0.6.18

No user-facing changes.

0.6.17

No user-facing changes.

0.6.16

No user-facing changes.

0.6.15

No user-facing changes.

0.6.14

No user-facing changes.

0.6.13

No user-facing changes.

0.6.12

No user-facing changes.

0.6.11

No user-facing changes.

0.6.10

No user-facing changes.

0.6.9

Minor Analysis Improvements

• Actions analysis now reports file coverage information on the CodeQL status page.

0.6.8

No user-facing changes.

0.6.7

No user-facing changes.

0.6.6

No user-facing changes.

0.6.5

No user-facing changes.

0.6.4

No user-facing changes.

0.6.3

No user-facing changes.

0.6.2

Minor Analysis Improvements

• The query actions/missing-workflow-permissions is now aware of the minimal permissions needed for the actions deploy-pages, delete-package-versions, ai-inference. This should lead to better alert messages and better fix suggestions.

0.6.1

No user-facing changes.

0.6.0

Breaking Changes

• The following queries have been removed from the security-and-quality suite. They are not intended to produce user-facing alerts describing vulnerabilities. Any existing alerts for these queries will be closed automatically.
  • actions/composite-action-sinks
  • actions/composite-action-sources
  • actions/composite-action-summaries
  • actions/reusable-workflow-sinks (renamed from actions/reusable-wokflow-sinks)
  • actions/reusable-workflow-sources
  • actions/reusable-workflow-summaries

Bug Fixes

• Assigned a security-severity to the query actions/excessive-secrets-exposure.

0.5.4

New Features

• CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.

Bug Fixes

• Alerts produced by the query actions/missing-workflow-permissions now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.

0.5.3

Bug Fixes

• Fixed typos in the query and alert titles for the queries actions/envpath-injection/critical, actions/envpath-injection/medium, actions/envvar-injection/critical, and actions/envvar-injection/medium.

0.5.2

No user-facing changes.

0.5.1

Bug Fixes

• The actions/unversioned-immutable-action query will no longer report any alerts, since the Immutable Actions feature is not yet available for customer use. The query has also been moved to the experimental folder and will not be used in code scanning unless it is explicitly added to a code scanning configuration. Once the Immutable Actions feature is available, the query will be updated to report alerts again.

0.5.0

Breaking Changes

• The following queries have been removed from the code-scanning and security-extended suites. Any existing alerts for these queries will be closed automatically.

  • actions/if-expression-always-true/critical
  • actions/if-expression-always-true/high
  • actions/unnecessary-use-of-advanced-config

• The following query has been moved from the code-scanning suite to the security-extended suite. Any existing alerts for this query will be closed automatically unless the analysis is configured to use the security-extended suite.

  • actions/unpinned-tag

• The following queries have been added to the security-extended suite.

  • actions/unversioned-immutable-action
  • actions/envpath-injection/medium
  • actions/envvar-injection/medium
  • actions/code-injection/medium
  • actions/artifact-poisoning/medium
  • actions/untrusted-checkout/medium

Minor Analysis Improvements

• Fixed false positives in the query actions/unpinned-tag (CWE-829), which will no longer flag uses of Docker-based GitHub actions pinned by the container's SHA256 digest.

0.4.2

No user-facing changes.

0.4.1

No user-facing changes.

0.4.0

New Queries

• Initial public preview release