Commits

Commit history

1. Commits on Oct 6, 2026

   • Address review comments

     owen-mc

     committed
     84ed5d6View commit details

     Copy full SHA for 84ed5d6

     View code at this pointBrowse repository at this point
2. Commits on Oct 5, 2026

   • Actions: ensure CFG callable scopes are unique

     Show description for 755e78b
     

     owen-mc

     and

     Copilot

     committed
     755e78bView commit details

     Copy full SHA for 755e78b

     View code at this pointBrowse repository at this point

   • Actions: model environment expressions at declarations

     Show description for 95efef3
     

     owen-mc

     and

     Copilot

     committed
     95efef3View commit details

     Copy full SHA for 95efef3

     View code at this pointBrowse repository at this point

   • Actions: migrate to shared CFG library

     Show description for e17bfa5
     

     owen-mc

     and

     Copilot

     committed
     e17bfa5View commit details

     Copy full SHA for e17bfa5

     View code at this pointBrowse repository at this point
3. Commits on Sep 18, 2026

   • Merge origin/main into Actions owner distrust branch

     Show description for 8a67fab
     

     redsun82

     and

     Copilot

     committed
     8a67fabView commit details

     Copy full SHA for 8a67fab

     View code at this pointBrowse repository at this point
4. Commits on Sep 16, 2026

   • Inline expectations: Ignore results in files outside the source dir

     hvitved

     committed
     0aba99bView commit details

     Copy full SHA for 0aba99b

     View code at this pointBrowse repository at this point
5. Commits on Sep 11, 2026

   • Actions: address lockfile review feedback

     nodeselector

     committed
     53a7851View commit details

     Copy full SHA for 53a7851

     View code at this pointBrowse repository at this point
6. Commits on Sep 9, 2026

   • Actions lockfiles: match repository casing

     nodeselector

     committed
     a2213aeView commit details

     Copy full SHA for a2213ae

     View code at this pointBrowse repository at this point

   • Actions lockfiles: ignore schema version value

     nodeselector

     committed
     2b7e7abView commit details

     Copy full SHA for 2b7e7ab

     View code at this pointBrowse repository at this point

   • Actions tests: keep inline adapter outside library API

     nodeselector

     committed
     38f59dfView commit details

     Copy full SHA for 38f59df

     View code at this pointBrowse repository at this point

   • Actions tests: share inline expectations utility

     nodeselector

     committed
     e005d15View commit details

     Copy full SHA for e005d15

     View code at this pointBrowse repository at this point

   • Actions tests: add lockfile inline expectations

     nodeselector

     committed
     24a18e4View commit details

     Copy full SHA for 24a18e4

     View code at this pointBrowse repository at this point

   • Actions: consume extracted lockfile pins

     nodeselector

     committed
     2e04003View commit details

     Copy full SHA for 2e04003

     View code at this pointBrowse repository at this point

   • actions/unpinned-tag: regenerate expected results after sync

     nodeselector

     committed
     45a6dd7View commit details

     Copy full SHA for 45a6dd7

     View code at this pointBrowse repository at this point

   • actions/unpinned-tag: normalize lockfile action identity

     nodeselector

     committed
     91faa26View commit details

     Copy full SHA for 91faa26

     View code at this pointBrowse repository at this point

   • actions: drop lockfile-extension generator from unpinned-tag PR

     Show description for 77ac6d9
     nodeselector

     committed
     77ac6d9View commit details

     Copy full SHA for 77ac6d9

     View code at this pointBrowse repository at this point

   • actions/unpinned-tag: match lockfile pins case-insensitively on owner/repo

     Show description for f8f8aa8
     nodeselector

     committed
     f8f8aa8View commit details

     Copy full SHA for f8f8aa8

     View code at this pointBrowse repository at this point

   • actions: rename self-reference to self repository in unpinned-tag

     Show description for feed864
     nodeselector

     committed
     feed864View commit details

     Copy full SHA for feed864

     View code at this pointBrowse repository at this point

   • actions: scaffold lockfile-aware pinning for unpinned-tag

     Show description for 180c109
     nodeselector

     committed
     180c109View commit details

     Copy full SHA for 180c109

     View code at this pointBrowse repository at this point

   • actions: stop unpinned-tag flagging $/ self-references

     Show description for 7fedff2
     nodeselector

     committed
     7fedff2View commit details

     Copy full SHA for 7fedff2

     View code at this pointBrowse repository at this point
7. Commits on Sep 2, 2026

   • Add actions.lock extraction

     Show description for 2377214
     hvitved

     committed
     2377214View commit details

     Copy full SHA for 2377214

     View code at this pointBrowse repository at this point
8. Commits on Aug 24, 2026

   • Use inline expectations for Actions test

     Show description for fe3eaa8
     

     redsun82

     and

     Copilot

     committed
     fe3eaa8View commit details

     Copy full SHA for fe3eaa8

     View code at this pointBrowse repository at this point

   • Support distrusting Actions owners via `!owner` entries

     Show description for bdf8710
     

     redsun82

     and

     Copilot

     committed
     bdf8710View commit details

     Copy full SHA for bdf8710

     View code at this pointBrowse repository at this point
9. Commits on Aug 19, 2026

   • Actions: AssociationIfCheck should not protect events that do not populate the checked field

     Show description for 1a43007
     

     computersarebad

     and

     Copilot

     committed
     1a43007View commit details

     Copy full SHA for 1a43007

     View code at this pointBrowse repository at this point
10. Commits on Aug 18, 2026

    • Add test coverage for sender, head_commit and commits checks

      Show description for dc6ee11
      

      computersarebad

      and

      Copilot

      committed
      dc6ee11View commit details

      Copy full SHA for dc6ee11

      View code at this pointBrowse repository at this point
11. Commits on Aug 17, 2026

    • Actions: ActorIfCheck should not protect events that do not populate the checked field

      Show description for 9251d21
      

      computersarebad

      and

      Copilot

      committed
      9251d21View commit details

      Copy full SHA for 9251d21

      View code at this pointBrowse repository at this point
12. Commits on Aug 12, 2026

    • Merge branch 'main' into fix-actions-unpinned-reusable-workflows

      theinfosecguy

      authored
      ed82161View commit details

      Copy full SHA for ed82161

      View code at this pointBrowse repository at this point
13. Commits on Aug 11, 2026

    • Merge branch 'main' into knewbury01/customize-actions-sanitizers

      mbaluda

      authored
      72ad4e5View commit details

      Copy full SHA for 72ad4e5

      View code at this pointBrowse repository at this point
14. Commits on Aug 5, 2026

    • Detect unpinned reusable workflows

      theinfosecguy

      committed
      d85deefView commit details

      Copy full SHA for d85deef

      View code at this pointBrowse repository at this point
15. Commits on Aug 4, 2026

    • Merge branch 'main' of https://github.com/github/codeql into fix/actions-cache-poisoning-cache-write-access

      JarLob

      committed
      6a2d7beView commit details

      Copy full SHA for 6a2d7be

      View code at this pointBrowse repository at this point

    • Merge pull request #22274 from JarLob/remove/actions-self-hosted-runner-query

      Show description for 2f2b4c8
      aschackmull

      authored
      2f2b4c8View commit details

      Copy full SHA for 2f2b4c8

      View code at this pointBrowse repository at this point
16. Commits on Aug 3, 2026

    • Actions: Remove experimental self-hosted runner query

      Show description for 7a7dae0
      JarLob

      committed
      7a7dae0View commit details

      Copy full SHA for 7a7dae0

      View code at this pointBrowse repository at this point
17. Commits on Jul 31, 2026

    • Reworded the misleading 'Unprivileged'

      JarLob

      committed
      c40fe85View commit details

      Copy full SHA for c40fe85

      View code at this pointBrowse repository at this point

    • Merge github/main into fix/actions-cache-poisoning-cache-write-access

      Show description for 827af90
      JarLob

      committed
      827af90View commit details

      Copy full SHA for 827af90

      View code at this pointBrowse repository at this point

    • Remove unreachable workflow_call cache access handling

      Show description for cd7f6b7
      JarLob

      committed
      cd7f6b7View commit details

      Copy full SHA for cd7f6b7

      View code at this pointBrowse repository at this point