github / github/codeql

Organization owned immutable actions raise warning about unpinned 3rd party actions tag

Abierto Apto para principiantes
#21,076 3 comentarios 3 reacciones 0 asignados Ver en GitHub
false-positive
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

This CodeQL warning is great, but its language specifically says 3rd party actions, but my actions are getting warnings even when they're immutable and owned by my organization.

https://github.com/github/codeql/blob/28b6aa8616a393ebb45186e3ba4df004a0f3ef4e/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql#L1-L12

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start with actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql, especially lines 1-12 linked in the issue, and inspect how the warning describes organization-owned immutable actions. Reproduce or examine that case, then verify that the warning wording and behavior accurately match the affected actions.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
github-actions
Área
security
Tipo de issue
Error
Dificultad
2/5
Tiempo estimado
1-3 horas
Estado de actividad
Activo
Claridad
Bastante claro
Aptitud para principiantes
70/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.