Organization owned immutable actions raise warning about unpinned 3rd party actions tag
Aberta
Para iniciantes
false-positive
- Linguagem predominante
- CodeQL
- Estrelas
- 10.1k
- Forks
- 2.1k
- Merge médio
- 2d 15h
- PRs com merge (30d)
- 141
Descrição
This CodeQL warning is great, but its language specifically says 3rd party actions, but my actions are getting warnings even when they're immutable and owned by my organization.
https://github.com/github/codeql/blob/28b6aa8616a393ebb45186e3ba4df004a0f3ef4e/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql#L1-L12
Guia de contribuição
Direção de pesquisa
Start with actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql, especially lines 1-12 linked in the issue, and inspect how the warning describes organization-owned immutable actions. Reproduce or examine that case, then verify that the warning wording and behavior accurately match the affected actions.
Escrita pelo modelo de indexação a partir do texto da issue.
Avaliação
- Stack de tecnologia
- github-actions
- Domínio
- security
- Tipo de issue
- Bug
- Dificuldade
- 2/5
- Tempo estimado
- 1-3 horas
- Status de atividade
- Ativa
- Clareza
- Razoavelmente clara
- Facilidade para iniciantes
- 70/100