Detect unpinned reusable workflows - #22285
Conversation
michaelnebel
left a comment
michaelnebel
left a comment
There was a problem hiding this comment.
Thank you very much!
Added a couple of nit comments / questions.
Will start a DCA run as well.
| exists(UsesStep step, CompositeAction action | | ||
| uses = step and | ||
| step.getEnclosingCompositeAction() = action and |
There was a problem hiding this comment.
nit suggestion
| exists(UsesStep step, CompositeAction action | | |
| uses = step and | |
| step.getEnclosingCompositeAction() = action and | |
| exists(CompositeAction action | | |
| uses.(UsesStep).getEnclosingCompositeAction() = action and |
There was a problem hiding this comment.
I suppose a Uses is implicitly a UsesStep if it has an enclosing composite action - so the cast is not needed either.
There was a problem hiding this comment.
Agreed and fixed.
| then isPinnedContainer(version) | ||
| else isPinnedCommit(version) | ||
| ) and | ||
| not exists(UsesStep step | uses = step and isImmutableAction(step, nwo)) and |
There was a problem hiding this comment.
Is a similar MaD escape hatch needed for reusable workflows?
There was a problem hiding this comment.
Good question. I don’t think the existing immutableActionsDataModel applies here. It models Immutable Actions used by steps, while reusable workflows aren’t resolved through that mechanism. They already get the trusted-owner exemption from this query.
|
DCA looks uneventful. |
2 participants
Fixes #21659.
Extends
actions/unpinned-tagto check reusable workflow calls.Tests cover mutable refs, pinned SHAs, trusted owners, and local workflows.