Merge upstream CodeQL 2.27.0 release

.github/workflows/check-change-note.yml

@@ -1,10 +1,11 @@
 name: Check change note
 
 permissions:
+  contents: read
   pull-requests: read
 
 on:
-  pull_request_target:
+  pull_request:
     types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
     paths:
       - "*/ql/src/**/*.ql"
@@ -23,7 +24,7 @@ jobs:
     env:
       REPO: ${{ github.repository }}
       PULL_REQUEST_NUMBER: ${{ github.event.number }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ github.token }}
     runs-on: ubuntu-latest
     steps:
 

.github/workflows/labeler.yml

@@ -1,15 +1,144 @@
 name: "Pull Request Labeler"
+
 on:
-- pull_request_target
+  schedule:
+    # Reconcile recently updated PRs promptly, including unapproved forks and
+    # conflicted PRs for which pull_request workflows do not run.
+    - cron: "7,22,37,52 * * * *"
+    # Reconcile one stable shard of all open PRs each hour to recover from
+    # delayed or missed scheduled runs.
+    - cron: "12 * * * *"
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Open pull request number to reconcile"
+        required: true
+        type: string
+
+permissions: {}
 
-permissions:
-  contents: read
-  pull-requests: write
+concurrency:
+  group: pull-request-labeler
+  cancel-in-progress: false
 
 jobs:
   triage:
+    if: github.ref_name == github.event.repository.default_branch
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
-    - uses: actions/labeler@v4
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/labeler.yml
+          sparse-checkout-cone-mode: false
+
+      - name: Collect pull requests to reconcile
+        id: collect
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          SCHEDULE: ${{ github.event.schedule }}
+          REQUESTED_PR: ${{ inputs.pr_number }}
+        run: |
+          set -euo pipefail
+
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            if [[ ! "$REQUESTED_PR" =~ ^[1-9][0-9]*$ ]]; then
+              echo "Invalid pull request number: $REQUESTED_PR"
+              exit 1
+            fi
+
+            pr_json=$(gh api "repos/$REPO/pulls/$REQUESTED_PR")
+            candidates=$(jq -c '[{
+              number: .number,
+              head_sha: .head.sha
+            }]' <<<"$pr_json")
+          else
+            pulls_json=$(gh api --paginate \
+              "repos/$REPO/pulls?state=open&sort=updated&direction=desc&per_page=100" |
+              jq -cs 'add')
+
+            if [ "$SCHEDULE" = "12 * * * *" ]; then
+              shard=$(( ($(date -u +%s) / 3600) % 6 ))
+              candidates=$(jq -c --argjson shard "$shard" \
+                '[.[] | select((.number % 6) == $shard) | {
+                  number: .number,
+                  head_sha: .head.sha
+                }]' <<<"$pulls_json")
+            else
+              cutoff=$(date -u -d "1 hour ago" "+%Y-%m-%dT%H:%M:%SZ")
+              # Hourly shards reconcile any candidates beyond this API budget.
+              candidates=$(jq -c --arg cutoff "$cutoff" \
+                '[.[] | select(.updated_at >= $cutoff) | {
+                  number: .number,
+                  head_sha: .head.sha
+                }][0:100]' <<<"$pulls_json")
+            fi
+          fi
+
+          echo "Collected $(jq 'length' <<<"$candidates") pull request(s)."
+          {
+            echo "candidates<<EOF"
+            echo "$candidates"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Validate pull request state
+        id: validate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          CANDIDATES: ${{ steps.collect.outputs.candidates }}
+        run: |
+          set -euo pipefail
+
+          valid_numbers=()
+          while IFS=$'\t' read -r pr_number expected_sha; do
+            if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]] ||
+              [[ ! "$expected_sha" =~ ^[0-9a-f]{40}$ ]]; then
+              echo "Skipping malformed pull request candidate."
+              continue
+            fi
+
+            if ! pr_json=$(gh api "repos/$REPO/pulls/$pr_number"); then
+              echo "Pull request #$pr_number could not be fetched; skipping."
+              continue
+            fi
+
+            if ! jq -e \
+              --arg repo "$REPO" \
+              --arg sha "$expected_sha" \
+              '.state == "open" and
+               .base.repo.full_name == $repo and
+               .head.sha == $sha and
+               (.head.repo.full_name | type == "string")' \
+              >/dev/null <<<"$pr_json"; then
+              echo "Pull request #$pr_number changed or is no longer open; skipping."
+              continue
+            fi
+
+            valid_numbers+=("$pr_number")
+          done < <(jq -r '.[] | [.number, .head_sha] | @tsv' <<<"$CANDIDATES")
+
+          if [ "${#valid_numbers[@]}" -eq 0 ]; then
+            echo "has_prs=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          {
+            echo "has_prs=true"
+            echo "pr_numbers<<EOF"
+            printf '%s\n' "${valid_numbers[@]}"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: actions/labeler@v4
+        if: steps.validate.outputs.has_prs == 'true'
+        with:
+          repo-token: "${{ github.token }}"
+          pr-number: ${{ steps.validate.outputs.pr_numbers }}

BUILD.bazel

@@ -3,3 +3,11 @@ exports_files([
     "Cargo.lock",
     "Cargo.toml",
 ])
+
+constraint_setting(name = "swift_runtime_linkage")
+
+constraint_value(
+    name = "static_swift_runtime",
+    constraint_setting = ":swift_runtime_linkage",
+    visibility = ["//visibility:public"],
+)

MODULE.bazel

@@ -31,7 +31,7 @@ bazel_dep(name = "gazelle", version = "0.50.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 bazel_dep(name = "rules_rust", version = "0.69.0")
-bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.1")
+bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.2")
 bazel_dep(name = "swift-syntax", version = "603.0.2")
 bazel_dep(name = "zstd", version = "1.5.7.bcr.1")
 
@@ -228,7 +228,7 @@ use_repo(
 # `unified/swift-syntax-rs` package is not loadable in that context. Keep this
 # in sync with `unified/swift-syntax-rs/.swift-version` (used by the `cargo`
 # build) and the `swift-syntax` release in `swift/Package.swift`.
-swift = use_extension("@rules_swift//swift:extensions.bzl", "swift")
+swift = use_extension("@rules_swift//swift:extensions.bzl", "swift", dev_dependency = True)
 swift.toolchain(
     name = "swift_toolchain",
     swift_version = "6.3.3",
@@ -237,12 +237,15 @@ use_repo(
     swift,
     "swift_toolchain",
     "swift_toolchain_ubuntu22.04",
+    "swift_toolchain_ubuntu22.04-aarch64",
     "swift_toolchain_xcode",
 )
 
 register_toolchains(
     "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04",
+    "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04-aarch64",
     "@swift_toolchain//:swift_toolchain_exec_xcode",
+    dev_dependency = True,
 )
 
 node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")

actions/extractor/tools/autobuild-impl.ps1

@@ -9,7 +9,8 @@ $DefaultPathFilters = @(
     'include:.github/reusable_workflows/**/*.yml',
     'include:.github/reusable_workflows/**/*.yaml',
     'include:**/action.yml',
-    'include:**/action.yaml'
+    'include:**/action.yaml',
+    'include:**/actions.lock'
 )
 
 if ($null -ne $env:LGTM_INDEX_FILTERS) {

actions/extractor/tools/autobuild.sh

@@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
 include:.github/reusable_workflows/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
+include:**/actions.lock
 END
 )
 

actions/extractor/tools/baseline-config.json

@@ -5,6 +5,7 @@
         ".github/reusable_workflows/**/*.yml",
         ".github/reusable_workflows/**/*.yaml",
         "**/action.yml",
-        "**/action.yaml"
+        "**/action.yaml",
+        "**/actions.lock"
     ]
 }

actions/ql/integration-tests/actions-lock/query/actions.ql

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

actions/ql/integration-tests/actions-lock/query/qlpack.yml

@@ -0,0 +1,4 @@
+name: codeql/actions-lock-integration-test
+dependencies:
+  codeql/actions-all: "*"
+warnOnImplicitThis: true

actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/integration-tests/actions-lock/src/actions.lock

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/integration-tests/actions-lock/test.py

@@ -0,0 +1,4 @@
+def test_actions_lock(codeql, actions, javascript):
+    codeql.database.create(source_root="src", language="actions")
+    output = codeql.query.run("query/actions.ql", database="test-db", _capture=True)
+    assert "actions.lock" in output

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.6.1
+
+### New Features
+
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.
+
+### Minor Analysis Improvements
+
+* Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+
 ## 0.6.0
 
 ### Breaking Changes

actions/ql/lib/actions.qll

@@ -1 +1,2 @@
 import codeql.actions.Ast
+import codeql.actions.Lock

actions/ql/lib/change-notes/released/0.6.1.md

@@ -0,0 +1,10 @@
+## 0.6.1
+
+### New Features
+
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.
+
+### Minor Analysis Improvements
+
+* Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1

actions/ql/lib/codeql/actions/Lock.qll

@@ -0,0 +1,10 @@
+/**
+ * Provides classes for working with GitHub Actions lockfiles.
+ */
+
+private import codeql.actions.ast.internal.Yaml
+
+/** An `actions.lock` file. */
+class ActionsLock extends YamlDocument {
+  ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
+}

actions/ql/lib/codeql/actions/security/ControlChecks.qll

@@ -408,16 +408,37 @@ class WorkflowRunRepositoryIfCheck extends RepositoryCheck instanceof If {
   }
 }
 
+/**
+ * Gets a regular expression matching a condition on an author association field
+ * that is only populated for events whose payload contains the `context_prefix`
+ * context.
+ */
+private string eventPayloadAssociationFieldRegex(string context_prefix) {
+  context_prefix = "github.event.comment" and
+  result = "\\bgithub\\.event\\.comment\\.author_association\\b"
+  or
+  context_prefix = "github.event.issue" and
+  result = "\\bgithub\\.event\\.issue\\.author_association\\b"
+  or
+  context_prefix = "github.event.pull_request" and
+  result = "\\bgithub\\.event\\.pull_request\\.author_association\\b"
+}
+
 class AssociationIfCheck extends AssociationCheck instanceof If {
+  string context_prefix;
+
   AssociationIfCheck() {
     // eg: contains(fromJson('["MEMBER", "OWNER"]'), github.event.comment.author_association)
-    normalizeExpr(this.getCondition())
-        .splitAt("\n")
-        .regexpMatch([
-            ".*\\bgithub\\.event\\.comment\\.author_association\\b.*",
-            ".*\\bgithub\\.event\\.issue\\.author_association\\b.*",
-            ".*\\bgithub\\.event\\.pull_request\\.author_association\\b.*",
-          ])
+    exists(
+      normalizeExpr(this.getCondition())
+          .regexpFind(eventPayloadAssociationFieldRegex(context_prefix), _, _)
+    )
+  }
+
+  override predicate protectsCategoryAndEvent(string category, string event) {
+    AssociationCheck.super.protectsCategoryAndEvent(category, event) and
+    // association fields only restrict events whose payload populates them
+    contextTriggerDataModel(event, context_prefix)
   }
 }
 

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.6.0
+version: 0.6.1
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.35
+
+No user-facing changes.
+
 ## 0.6.34
 
 ### Minor Analysis Improvements

actions/ql/src/change-notes/released/0.6.35.md

@@ -0,0 +1,3 @@
+## 0.6.35
+
+No user-facing changes.