CodeQL query help for GitHub Actions¶
Visit the articles below to see the documentation for the queries included in the following query suites:
default: queries run by default in CodeQL code scanning on GitHub.security-extended: queries fromdefault, plus extra security queries with slightly lower precision and severity.security-and-quality: queries fromdefault,security-extended, plus extra maintainability and reliability queries.
These queries are published in the CodeQL query pack codeql/actions-queries (changelog, source).
- Artifact poisoning
- Artifact poisoning
- Cache Poisoning via caching of untrusted files
- Cache Poisoning via code injection
- Cache Poisoning via execution of untrusted code
- Checkout of untrusted code in a non-privileged context
- Checkout of untrusted code in a privileged context
- Checkout of untrusted code in a privileged context
- Code injection
- Code injection
- Environment variable built from user-controlled sources
- Environment variable built from user-controlled sources
- Excessive Secrets Exposure
- If expression always true
- If expression always true
- Improper Access Control
- PATH environment variable built from user-controlled sources
- PATH environment variable built from user-controlled sources
- Storage of sensitive information in GitHub Actions artifact
- Unmasked Secret Exposure
- Unpinned tag for a non-immutable Action or reusable workflow
- Untrusted Checkout TOCTOU
- Untrusted Checkout TOCTOU
- Use of a known vulnerable action
- Workflow Should Use Default Setup
- Workflow does not contain permissions