Commits

Commit history

1. Commits on Sep 9, 2026

   • Code review suggestions

     

     hvitved

     authored and

     nodeselector

     committed
     ff9bf5dView commit details

     Copy full SHA for ff9bf5d

     View code at this pointBrowse repository at this point

   • Actions: consume extracted lockfile pins

     nodeselector

     committed
     2e04003View commit details

     Copy full SHA for 2e04003

     View code at this pointBrowse repository at this point

   • actions/unpinned-tag: normalize lockfile action identity

     nodeselector

     committed
     91faa26View commit details

     Copy full SHA for 91faa26

     View code at this pointBrowse repository at this point

   • actions: drop lockfile-extension generator from unpinned-tag PR

     Show description for 77ac6d9
     nodeselector

     committed
     77ac6d9View commit details

     Copy full SHA for 77ac6d9

     View code at this pointBrowse repository at this point

   • actions/unpinned-tag: match lockfile pins case-insensitively on owner/repo

     Show description for f8f8aa8
     nodeselector

     committed
     f8f8aa8View commit details

     Copy full SHA for f8f8aa8

     View code at this pointBrowse repository at this point

   • actions: rename self-reference to self repository in unpinned-tag

     Show description for feed864
     nodeselector

     committed
     feed864View commit details

     Copy full SHA for feed864

     View code at this pointBrowse repository at this point

   • actions: scaffold lockfile-aware pinning for unpinned-tag

     Show description for 180c109
     nodeselector

     committed
     180c109View commit details

     Copy full SHA for 180c109

     View code at this pointBrowse repository at this point

   • actions: stop unpinned-tag flagging $/ self-references

     Show description for 7fedff2
     nodeselector

     committed
     7fedff2View commit details

     Copy full SHA for 7fedff2

     View code at this pointBrowse repository at this point
2. Commits on Aug 12, 2026

   • Simplify composite action lookup

     theinfosecguy

     committed
     710a753View commit details

     Copy full SHA for 710a753

     View code at this pointBrowse repository at this point
3. Commits on Aug 5, 2026

   • Detect unpinned reusable workflows

     theinfosecguy

     committed
     d85deefView commit details

     Copy full SHA for d85deef

     View code at this pointBrowse repository at this point
4. Commits on Aug 4, 2026

   • Merge branch 'main' of https://github.com/github/codeql into fix/actions-cache-poisoning-cache-write-access

     JarLob

     committed
     6a2d7beView commit details

     Copy full SHA for 6a2d7be

     View code at this pointBrowse repository at this point
5. Commits on Jul 31, 2026

   • Reworded the misleading 'Unprivileged'

     JarLob

     committed
     c40fe85View commit details

     Copy full SHA for c40fe85

     View code at this pointBrowse repository at this point

   • Merge github/main into fix/actions-cache-poisoning-cache-write-access

     Show description for 827af90
     JarLob

     committed
     827af90View commit details

     Copy full SHA for 827af90

     View code at this pointBrowse repository at this point

   • Merge pull request #22243 from JarLob/improve/actions-untrusted-checkout-source-link

     Show description for ddb7e3f
     aschackmull

     authored
     ddb7e3fView commit details

     Copy full SHA for ddb7e3f

     View code at this pointBrowse repository at this point

   • Apply batched suggestions from code review

     Show description for 9d147bc
     

     JarLob

     and

     aschackmull

     authored
     9d147bcView commit details

     Copy full SHA for 9d147bc

     View code at this pointBrowse repository at this point

   • Delay envvar event-name correlation

     JarLob

     committed
     de68881View commit details

     Copy full SHA for de68881

     View code at this pointBrowse repository at this point

   • Fix FP in envvar injection

     JarLob

     committed
     26da3e7View commit details

     Copy full SHA for 26da3e7

     View code at this pointBrowse repository at this point
6. Commits on Jul 30, 2026

   • Account cache poisoning queries for read-only access on low-trust triggers

     JarLob

     committed
     761de92View commit details

     Copy full SHA for 761de92

     View code at this pointBrowse repository at this point
7. Commits on Jul 28, 2026

   • Write a clickable source link in untrusted checkout message

     JarLob

     committed
     43d485aView commit details

     Copy full SHA for 43d485a

     View code at this pointBrowse repository at this point

   • Improve untrusted checkout path provenance

     Show description for 78a9f24
     JarLob

     committed
     78a9f24View commit details

     Copy full SHA for 78a9f24

     View code at this pointBrowse repository at this point

   • Combine a value-provenance prefix with the existing execution-order suffix for cache poisoning query

     JarLob

     committed
     99675aeView commit details

     Copy full SHA for 99675ae

     View code at this pointBrowse repository at this point

   • Add named related locations for cache poisoning query

     JarLob

     committed
     b2641e1View commit details

     Copy full SHA for b2641e1

     View code at this pointBrowse repository at this point
8. Commits on Jun 25, 2026

   • Merge pull request #21986 from JarLob/userpermissions

     Show description for b67644c
     redsun82

     authored
     b67644cView commit details

     Copy full SHA for b67644c

     View code at this pointBrowse repository at this point
9. Commits on Jun 18, 2026

   • Fix false negatives when one of the jobs had proper checks and the other didn't

     JarLob

     committed
     2d6feb1View commit details

     Copy full SHA for 2d6feb1

     View code at this pointBrowse repository at this point
10. Commits on Jun 4, 2026

    • Correct query metadata for `actions/untrusted-checkout/medium`

      henrymercer

      committed
      f4dc86eView commit details

      Copy full SHA for f4dc86e

      View code at this pointBrowse repository at this point
11. Commits on May 21, 2026

    • Merge branch 'main' into knewbury01/adjust-actions-queries-untrusted-checkout-second-iteration

      knewbury01

      authored
      5503140View commit details

      Copy full SHA for 5503140

      View code at this pointBrowse repository at this point

    • Fix merge conflicts

      knewbury01

      committed
      a094a8eView commit details

      Copy full SHA for a094a8e

      View code at this pointBrowse repository at this point

    • Address review feedback

      knewbury01

      committed
      2f8c0dfView commit details

      Copy full SHA for 2f8c0df

      View code at this pointBrowse repository at this point

    • Merge pull request #21800 from knewbury01/knewbury01/adjust-actions-queries-untrusted-checkout-critical-alert

      Show description for 2280955
      owen-mc

      authored
      2280955View commit details

      Copy full SHA for 2280955

      View code at this pointBrowse repository at this point
12. Commits on May 19, 2026

    • Adjust wording helpfiles UntrustedCheckoutX all three files

      knewbury01

      committed
      bfc6deeView commit details

      Copy full SHA for bfc6dee

      View code at this pointBrowse repository at this point

    • Adjust name UntrustedCheckoutHigh wording trusted to privileged

      knewbury01

      committed
      0a87658View commit details

      Copy full SHA for 0a87658

      View code at this pointBrowse repository at this point
13. Commits on May 18, 2026

    • Merge pull request #21838 from github/copilot/widen-regex-for-pinned-actions

      Show description for ad69cfb
      owen-mc

      authored
      ad69cfbView commit details

      Copy full SHA for ad69cfb

      View code at this pointBrowse repository at this point

    • Merge pull request #21692 from github/copilot/update-codeql-query-for-composite-actions

      Show description for 8a199f9
      oscarsj

      authored
      8a199f9View commit details

      Copy full SHA for 8a199f9

      View code at this pointBrowse repository at this point
14. Commits on May 14, 2026

    • Improve UntrustedCheckoutX helpfiles

      knewbury01

      committed
      914c7e1View commit details

      Copy full SHA for 914c7e1

      View code at this pointBrowse repository at this point

    • Add full stop to alert messages in UntrustedCheckoutHigh and UntrustedCheckoutCritical

      knewbury01

      committed
      29ffd87View commit details

      Copy full SHA for 29ffd87

      View code at this pointBrowse repository at this point