Restore CodeQL suppression to correct location in 'with:' block#460
Closed
greenc-FNAL wants to merge 1 commit intomainfrom
Closed
Restore CodeQL suppression to correct location in 'with:' block#460greenc-FNAL wants to merge 1 commit intomainfrom
greenc-FNAL wants to merge 1 commit intomainfrom
Conversation
The CodeQL suppression for actions/untrusted-checkout/medium must be placed within the 'with:' block of the checkout step, not before the step name or before the 'uses:' line. This is the correct location for CodeQL's YAML parser to recognize and apply the suppression. This action is safe because: - It's never called from pull_request_target workflows - Uses unprivileged triggers (pull_request, issue_comment, workflow_dispatch, workflow_call) - Empty sparse checkout ensures no PR files are materialized on disk - Only git objects are fetched for diff/ls-tree operations - No code from the PR is ever executed Fixes: GitHub CodeQL alerts #111/#171 (bouncing instances of same rule) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
greenc-FNAL
requested review from
aolivier23,
knoepfel and
marcpaterno
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adjusts the placement of the CodeQL suppression for actions/untrusted-checkout/medium so CodeQL’s YAML parser correctly associates it with the actions/checkout step in the run-change-detection composite action.
Changes:
- Moved the
# codeql[actions/untrusted-checkout/medium]suppression comment into thewith:block of the checkout step (immediately beforeref:). - Relocated the accompanying rationale comment block to sit alongside the suppressed
ref:input.
Member
|
Closing as there are no longer any flagged security issues. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CodeQL suppression for actions/untrusted-checkout/medium must be placed
within the 'with:' block of the checkout step, not before the step name or
before the 'uses:' line. This is the correct location for CodeQL's YAML
parser to recognize and apply the suppression.
This action is safe because:
Fixes: GitHub CodeQL alerts #111/#171 (bouncing instances of same rule)
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com