GitHub Actions queries for CodeQL analysis

Explore the queries that CodeQL uses to analyze code written in GitHub Actions workflow files when you select the default or the security-extended query suite.

Кто может использовать эту функцию?

CodeQL доступен для следующих типов репозитория:

CodeQL includes many queries for analyzing GitHub Actions workflows. All queries in the default query suite are run by default. If you choose to use the security-extended query suite, additional queries are run. For more information, see CodeQL query suites.

Built-in queries for GitHub Actions analysis

This table lists the queries available with the latest release of the CodeQL action and CodeQL CLI. For more information, see CodeQL change logs in the CodeQL documentation site.

Примечание.

The initial release of GitHub Enterprise Server 3.19 included CodeQL action and CodeQL CLI 2.22.4, which may not include all of these queries. Your site administrator can update your CodeQL version to a newer release. For more information, see Configuring code scanning for your appliance.

Query nameRelated CWEsDefaultExtendedCopilot Autofix
Artifact poisoning829
Cache Poisoning via caching of untrusted files349
Cache Poisoning via execution of untrusted code349
Cache Poisoning via low-privileged code injection349, 094
Checkout of untrusted code in a privileged context829
Checkout of untrusted code in trusted context829
Code injection094, 095, 116
Environment variable built from user-controlled sources077, 020
Excessive Secrets Exposure312
Improper Access Control285
PATH environment variable built from user-controlled sources077, 020
Storage of sensitive information in GitHub Actions artifact312
Unmasked Secret Exposure312
Untrusted Checkout TOCTOU367
Untrusted Checkout TOCTOU367
Use of a known vulnerable action1395
Workflow does not contain permissions275
Artifact poisoning829
Checkout of untrusted code in trusted context829
Code injection094, 095, 116
Environment variable built from user-controlled sources077, 020
PATH environment variable built from user-controlled sources077, 020
Unpinned tag for a non-immutable Action in workflow829