Organization owned immutable actions raise warning about unpinned 3rd party actions tag
Ouverte
Adaptée aux débutants
false-positive
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
This CodeQL warning is great, but its language specifically says 3rd party actions, but my actions are getting warnings even when they're immutable and owned by my organization.
https://github.com/github/codeql/blob/28b6aa8616a393ebb45186e3ba4df004a0f3ef4e/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql#L1-L12
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start with actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql, especially lines 1-12 linked in the issue, and inspect how the warning describes organization-owned immutable actions. Reproduce or examine that case, then verify that the warning wording and behavior accurately match the affected actions.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- github-actions
- Domaine
- security
- Type d'issue
- Bug
- Difficulté
- 2/5
- Temps estimé
- 1-3 heures
- Activité
- Active
- Clarté
- Plutôt claire
- Accessibilité débutants
- 70/100