github / github/codeql

Actions: imprecise action references in model data

Aberta
#19,635 4 comentários 0 reações 0 responsáveis Ver no GitHub
question
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

First of all, thanks for your hard work! I'm a huge fan of CodeQL, and I think support for GitHub Actions within it is amazing.

I'm filing this because I recently tried to consume some of CodeQL's "models" in an external tool (https://github.com/zizmorcore/zizmor/pull/849), and noticed what I _think_ is a model imprecision/data quality issue.

## Description

For example, `actions/ql/lib/ext/generated/composite-actions/airbytehq_airbyte.model.yml`:

```yaml
extensions:
- addsTo:
pack: codeql/actions-all
extensible: actionsSinkModel
data:
- ["airbytehq/airbyte", "*", "input.options", "code-injection", "generated"]
- ["airbytehq/airbyte", "*", "input.subcommand", "code-injection", "generated"]
```

([Permalink](https://github.com/github/codeql/blob/f6231a37e119a2a4b263e7d521e61fda40b80ec7/actions/ql/lib/ext/generated/composite-actions/airbytehq_airbyte.model.yml))

This implies that `airbytehq/airbyte` has a top-level `action.ya?ml` definition, but it doesn't: instead, it has a set of actions defined under `airbytehq/airbyte/.github/actions`, of which `run-airbyte-ci` appears to have the relevant injectable inputs:

```yaml
name: "Run Dagger pipeline"
description: "Runs a given dagger pipeline"
inputs:
subcommand:
description: "Subcommand for airbyte-ci"
required: true
```

([Permalink](https://github.com/airbytehq/airbyte/blob/1804c4958793342168b99dd938f781bc764e9c6a/.github/actions/run-airbyte-ci/action.yml))

This appears to be true in most other model files in that directory, at least the ones marked with `"generated"` in their definitions.

## Expected behavior

Given that the inputs in question occur in in an action that isn't at the repository root, I expected the model YAML to look roughly like this:

```yaml
extensions:
- addsTo:
pack: codeql/actions-all
extensible: actionsSinkModel
data:
- ["airbytehq/airbyte/.github/actions/run-airbyte-ci", "*", "input.options", "code-injection", "generated"]
- ["airbytehq/airbyte/.github/actions/run-airbyte-ci", "*", "input.subcommand", "code-injection", "generated"]
```

## Actual behavior

The model YAML lists `airbytehq/airbyte`, leaving it unclear *which* actions within that repository have the injectable inputs.

Guia de contribuição

Abrir o guia de contribuição

Direção de pesquisa

Start with actions/ql/lib/ext/generated/composite-actions/airbytehq_airbyte.model.yml and compare its repository reference with the linked .github/actions/run-airbyte-ci/action.yml. Inspect other generated model files marked "generated" to determine whether the same path issue is widespread; done means generated entries identify the specific nested action containing each input.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Stack de tecnologia
github-actions, yaml
Domínio
security
Tipo de issue
Bug
Dificuldade
4/5
Tempo estimado
3-5 dias
Status de atividade
Estagnada
Clareza
Claramente especificada
Facilidade para iniciantes
38/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.