Commits

Commit history

1. Commits on Oct 29, 2026

   • Release preparation for version 2.27.4

     

     github-actions[bot]

     committed
     beaf5dcView commit details

     Copy full SHA for beaf5dc

     View code at this pointBrowse repository at this point
2. Commits on Oct 15, 2026

   • Release preparation for version 2.27.3

     

     github-actions[bot]

     committed
     5dfcc34View commit details

     Copy full SHA for 5dfcc34

     View code at this pointBrowse repository at this point
3. Commits on Oct 1, 2026

   • Release preparation for version 2.27.2

     

     github-actions[bot]

     committed
     1317b66View commit details

     Copy full SHA for 1317b66

     View code at this pointBrowse repository at this point
4. Commits on Sep 17, 2026

   • Release preparation for version 2.27.1

     

     github-actions[bot]

     committed
     903466fView commit details

     Copy full SHA for 903466f

     View code at this pointBrowse repository at this point
5. Commits on Sep 9, 2026

   • Actions lockfiles: ignore schema version value

     nodeselector

     committed
     2b7e7abView commit details

     Copy full SHA for 2b7e7ab

     View code at this pointBrowse repository at this point

   • Actions: consume extracted lockfile pins

     nodeselector

     committed
     2e04003View commit details

     Copy full SHA for 2e04003

     View code at this pointBrowse repository at this point

   • actions/unpinned-tag: normalize lockfile action identity

     nodeselector

     committed
     91faa26View commit details

     Copy full SHA for 91faa26

     View code at this pointBrowse repository at this point

   • actions: use US spelling in lockfile-aware pinning comments

     Show description for 2db34d2
     nodeselector

     committed
     2db34d2View commit details

     Copy full SHA for 2db34d2

     View code at this pointBrowse repository at this point

   • actions: emit empty data list for zero-row lockfile extension

     Show description for b6a8394
     nodeselector

     committed
     b6a8394View commit details

     Copy full SHA for b6a8394

     View code at this pointBrowse repository at this point

   • actions: rename self-reference to self repository in unpinned-tag

     Show description for feed864
     nodeselector

     committed
     feed864View commit details

     Copy full SHA for feed864

     View code at this pointBrowse repository at this point

   • actions: drop machine-specific replace, document lockfile generator limits

     Show description for 9e7133b
     nodeselector

     committed
     9e7133bView commit details

     Copy full SHA for 9e7133b

     View code at this pointBrowse repository at this point

   • actions: scaffold lockfile-aware pinning for unpinned-tag

     Show description for 180c109
     nodeselector

     committed
     180c109View commit details

     Copy full SHA for 180c109

     View code at this pointBrowse repository at this point

   • actions: stop unpinned-tag flagging $/ self-references

     Show description for 7fedff2
     nodeselector

     committed
     7fedff2View commit details

     Copy full SHA for 7fedff2

     View code at this pointBrowse repository at this point
6. Commits on Sep 3, 2026

   • Release preparation for version 2.27.0

     

     github-actions[bot]

     committed
     da93726View commit details

     Copy full SHA for da93726

     View code at this pointBrowse repository at this point
7. Commits on Aug 20, 2026

   • Release preparation for version 2.26.4

     

     github-actions[bot]

     committed
     2bbab1bView commit details

     Copy full SHA for 2bbab1b

     View code at this pointBrowse repository at this point
8. Commits on Aug 12, 2026

   • Merge branch 'main' into fix-actions-unpinned-reusable-workflows

     theinfosecguy

     authored
     ed82161View commit details

     Copy full SHA for ed82161

     View code at this pointBrowse repository at this point
9. Commits on Aug 6, 2026

   • Release preparation for version 2.26.3

     

     github-actions[bot]

     committed
     fae4a92View commit details

     Copy full SHA for fae4a92

     View code at this pointBrowse repository at this point
10. Commits on Aug 5, 2026

    • Detect unpinned reusable workflows

      theinfosecguy

      committed
      d85deefView commit details

      Copy full SHA for d85deef

      View code at this pointBrowse repository at this point
11. Commits on Aug 4, 2026

    • Merge branch 'main' of https://github.com/github/codeql into fix/actions-cache-poisoning-cache-write-access

      JarLob

      committed
      6a2d7beView commit details

      Copy full SHA for 6a2d7be

      View code at this pointBrowse repository at this point
12. Commits on Jul 31, 2026

    • Add change note

      JarLob

      committed
      caf91c9View commit details

      Copy full SHA for caf91c9

      View code at this pointBrowse repository at this point

    • Merge github/main into fix/actions-cache-poisoning-cache-write-access

      Show description for 827af90
      JarLob

      committed
      827af90View commit details

      Copy full SHA for 827af90

      View code at this pointBrowse repository at this point

    • Merge remote-tracking branch 'github/main' into fix/actions-output-clobbering-regex

      Show description for c9727af
      JarLob

      committed
      c9727afView commit details

      Copy full SHA for c9727af

      View code at this pointBrowse repository at this point

    • Merge pull request #22243 from JarLob/improve/actions-untrusted-checkout-source-link

      Show description for ddb7e3f
      aschackmull

      authored
      ddb7e3fView commit details

      Copy full SHA for ddb7e3f

      View code at this pointBrowse repository at this point

    • Merge pull request #22235 from JarLob/fix/actions-envvar-injection-precision

      Show description for 0fb9774
      aschackmull

      authored
      0fb9774View commit details

      Copy full SHA for 0fb9774

      View code at this pointBrowse repository at this point

    • Merge branch 'main' into improve/actions-untrusted-checkout-source-link

      JarLob

      authored
      a44c25cView commit details

      Copy full SHA for a44c25c

      View code at this pointBrowse repository at this point

    • Fix FP in envvar injection

      JarLob

      committed
      26da3e7View commit details

      Copy full SHA for 26da3e7

      View code at this pointBrowse repository at this point

    • Merge remote-tracking branch 'github/main' into improve-clobbering-query-message

      Show description for 7f5c922
      JarLob

      committed
      7f5c922View commit details

      Copy full SHA for 7f5c922

      View code at this pointBrowse repository at this point

    • The regex wasn't escaping external input

      JarLob

      committed
      b9a5dd4View commit details

      Copy full SHA for b9a5dd4

      View code at this pointBrowse repository at this point

    • Merge pull request #22239 from JarLob/fix/actions-schedule-event-name

      Show description for 2a9f8c8
      aschackmull

      authored
      2a9f8c8View commit details

      Copy full SHA for 2a9f8c8

      View code at this pointBrowse repository at this point

    • Merge pull request #22252 from JarLob/fix/actions-output-clobbering-jq-precision

      Show description for 3b46482
      aschackmull

      authored
      3b46482View commit details

      Copy full SHA for 3b46482

      View code at this pointBrowse repository at this point
13. Commits on Jul 30, 2026

    • Account cache poisoning queries for read-only access on low-trust triggers

      JarLob

      committed
      761de92View commit details

      Copy full SHA for 761de92

      View code at this pointBrowse repository at this point
14. Commits on Jul 29, 2026

    • Restrict jq output-clobbering suppression

      JarLob

      committed
      5b96fccView commit details

      Copy full SHA for 5b96fcc

      View code at this pointBrowse repository at this point

    • Reduce false positives in the clobbering query

      JarLob

      committed
      44724a8View commit details

      Copy full SHA for 44724a8

      View code at this pointBrowse repository at this point

    • Improve clobbering query message and documentation

      JarLob

      committed
      e70ba7dView commit details

      Copy full SHA for e70ba7d

      View code at this pointBrowse repository at this point
15. Commits on Jul 28, 2026

    • Write a clickable source link in untrusted checkout message

      JarLob

      committed
      43d485aView commit details

      Copy full SHA for 43d485a

      View code at this pointBrowse repository at this point