Organization owned immutable actions raise warning about unpinned 3rd party actions tag
Offen
Anfängerfreundlich
false-positive
- Vorherrschende Sprache
- CodeQL
- Sterne
- 10.1k
- Forks
- 2.1k
- Ø Merge
- 2 T. 15 Std.
- Gemergte PRs (30 T.)
- 141
Beschreibung
This CodeQL warning is great, but its language specifically says 3rd party actions, but my actions are getting warnings even when they're immutable and owned by my organization.
https://github.com/github/codeql/blob/28b6aa8616a393ebb45186e3ba4df004a0f3ef4e/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql#L1-L12
Beitragsleitfaden
Rechercherichtung
Start with actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql, especially lines 1-12 linked in the issue, and inspect how the warning describes organization-owned immutable actions. Reproduce or examine that case, then verify that the warning wording and behavior accurately match the affected actions.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- github-actions
- Bereich
- security
- Issue-Typ
- Bug
- Schwierigkeit
- 2/5
- Geschätzter Aufwand
- 1-3 Stunden
- Aktivitätsstatus
- Aktiv
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 70/100