Support distrusting Actions owners via !owner entries - #22415
Open
redsun82 wants to merge 3 commits into
Open
Conversation
Lets `trustedActionsOwnerDataModel` remove an owner (including the first-party `actions`, `github` and `advanced-security`) with a `!`-prefixed entry, so unpinned tags for those Actions are reported by `actions/unpinned-tag`. Unambiguous because owner names can never start with `!`. Closes #22409 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds negated trusted-owner entries so users can flag unpinned first-party Actions.
Changes:
- Implements
!owneroverride semantics. - Adds isolated query coverage.
- Documents configuration and release impact.
Show a summary per file
| File | Description |
|---|---|
Config.qll |
Implements negated-owner filtering. |
UnpinnedActionsTag.qlref |
Registers the test query. |
UnpinnedActionsTag.ext.yml |
Distrusts actions in the test. |
UnpinnedActionsTag.expected |
Captures expected alerts. |
unpinned_first_party.yml |
Provides test workflows. |
customizing-library-models-for-actions.rst |
Documents !owner usage. |
2026-08-24-untrusted-actions-owner.md |
Adds the change note. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 7/7 changed files
- Comments generated: 0
- Review effort level: Balanced
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
`codeql.Locations` already re-exports it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitHub's first-party organizations (
actions,github,advanced-security) are trusted by default, soactions/unpinned-tagnever reports their unpinned tags. Some users want to hold first-party actions to the same pinning standard as everything else, but there was no way to opt an owner out of the trusted list.What
Adds an in-band negation convention to
trustedActionsOwnerDataModel: an entry prefixed with!removes the matching owner from the trusted set. For example, contributing["!github"]makes unpinnedgithub/*actions get flagged.This works entirely in the single
Config.qllwrapper that already interprets the extensible predicate, so no new predicate or query change is needed:!ownerform is not listed.!ownerentry always wins over a plainownerentry.!-prefixed sentinels are themselves excluded from the effective owner set.The
!prefix is unambiguous because GitHub owner names can never start with!.Notes for reviewers
actions/checkout) are exempted by the query independently of the trusted-owner list, so distrusting an owner cannot surface those. The new test therefore exercises non-immutable first-party actions.CWE-829-untrusted-owner/adds["!actions"]and asserts the previously-trusted owner is now flagged, while an untouched first-party owner stays trusted. The existingUnpinnedActionsTagtest is unchanged and still passes.Fixes: #22409