No user-facing changes.

• The actions/unpinned-tag query now detects mutable references to reusable workflows.

• The name and alert message of the actions/cache-poisoning/code-injection query have been reworded for clarity.

• The actions/output-clobbering/high query no longer reports simple jq path filters when their output remains JSON-encoded. Raw-output modes, complex filters, and unrecognized options remain reportable.
• GitHub Actions queries now correctly classify the schedule event when determining whether a workflow is externally triggerable.
• The actions/envvar-injection/critical query now requires the untrusted source and privileged context to originate from the same trigger event. The environment variable injection queries also no longer treat pull request head labels as injection-capable because they cannot contain newlines.
• The actions/cache-poisoning/code-injection, actions/cache-poisoning/direct-cache, and actions/cache-poisoning/poisonable-step queries now account for read-only cache access on low-trust triggers that run in the default branch scope. Results are retained for triggers that GitHub allows to write to that cache scope.

• The actions/output-clobbering/high query now provides messages tailored to the affected output channel and includes expanded documentation and recommendations.
• The actions/cache-poisoning/poisonable-step and actions/untrusted-checkout/critical queries now start paths at the expressions that control untrusted checkouts and link their alert messages to those expressions.
• Fixed a performance issue in the actions/output-clobbering/high query caused by using unescaped source-code input in a regular expression.

No user-facing changes.

No user-facing changes.

• The name, description, and alert message of actions/untrusted-checkout/medium have been corrected to describe a non-privileged context.

• Reversed adjustment of the name of actions/untrusted-checkout/high, but kept the portion of the previous change for the word "trusted" to "privileged". Added a missing "a" to phrasing in actions/untrusted-checkout/high and actions/untrusted-checkout/medium.

• Adjusted actions/untrusted-checkout/critical to align more with other untrusted resource queries, where the alert location is the location where the artifact is obtained from (the checkout point). This aligns with the other 2 related queries. This will cause the same alerts to re-open for closed alerts of this query.

• Altered the alert message for clarity for queries: actions/untrusted-checkout/critical, actions/untrusted-checkout/high.
• The actions/unpinned-tag query now recognizes 64-character SHA-256 commit hashes as properly pinned references, in addition to 40-character SHA-1 hashes.

• Adjusted (minor) help file descriptions for queries: actions/untrusted-checkout/critical, actions/untrusted-checkout/high, actions/untrusted-checkout/medium. Clarified wording on a minor point, added one more listed resource and added one more recommendation for things to check.

• Adjusted the name of actions/untrusted-checkout/high to more clearly describe which parts of the scenario are in a privileged context.

• The actions/unpinned-tag query now analyzes composite action metadata (action.yml/action.yaml files) in addition to workflow files, providing more comprehensive detection of unpinned action references across the entire Actions ecosystem.

• Fixed help file descriptions for queries: actions/untrusted-checkout/critical, actions/untrusted-checkout/high, actions/untrusted-checkout/medium. Previously the messages were unclear as to why and how the vulnerabilities could occur.

No user-facing changes.

• Fixed alert messages in actions/artifact-poisoning/critical and actions/artifact-poisoning/medium as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also improved the wording to make it clearer that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed. Finally, changed the alert location to be the source, to align more with other queries reporting an artifact (e.g. zipslip) which is more useful.

• The query actions/missing-workflow-permissions no longer produces false positive results on reusable workflows where all callers set permissions.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

• Actions analysis now reports file coverage information on the CodeQL status page.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

No user-facing changes.

• The query actions/missing-workflow-permissions is now aware of the minimal permissions needed for the actions deploy-pages, delete-package-versions, ai-inference. This should lead to better alert messages and better fix suggestions.

No user-facing changes.

• The following queries have been removed from the security-and-quality suite. They are not intended to produce user-facing alerts describing vulnerabilities. Any existing alerts for these queries will be closed automatically.
  • actions/composite-action-sinks
  • actions/composite-action-sources
  • actions/composite-action-summaries
  • actions/reusable-workflow-sinks (renamed from actions/reusable-wokflow-sinks)
  • actions/reusable-workflow-sources
  • actions/reusable-workflow-summaries

• Assigned a security-severity to the query actions/excessive-secrets-exposure.

• CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.

• Alerts produced by the query actions/missing-workflow-permissions now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.

• Fixed typos in the query and alert titles for the queries actions/envpath-injection/critical, actions/envpath-injection/medium, actions/envvar-injection/critical, and actions/envvar-injection/medium.

No user-facing changes.

• The actions/unversioned-immutable-action query will no longer report any alerts, since the Immutable Actions feature is not yet available for customer use. The query has also been moved to the experimental folder and will not be used in code scanning unless it is explicitly added to a code scanning configuration. Once the Immutable Actions feature is available, the query will be updated to report alerts again.

• The following queries have been removed from the code-scanning and security-extended suites. Any existing alerts for these queries will be closed automatically.

  • actions/if-expression-always-true/critical
  • actions/if-expression-always-true/high
  • actions/unnecessary-use-of-advanced-config

• The following query has been moved from the code-scanning suite to the security-extended suite. Any existing alerts for this query will be closed automatically unless the analysis is configured to use the security-extended suite.

  • actions/unpinned-tag

• The following queries have been added to the security-extended suite.

  • actions/unversioned-immutable-action
  • actions/envpath-injection/medium
  • actions/envvar-injection/medium
  • actions/code-injection/medium
  • actions/artifact-poisoning/medium
  • actions/untrusted-checkout/medium

• Fixed false positives in the query actions/unpinned-tag (CWE-829), which will no longer flag uses of Docker-based GitHub actions pinned by the container's SHA256 digest.

No user-facing changes.

No user-facing changes.

• Initial public preview release