nickrolfe · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026
@@ -0,0 +1,35 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/actions-all",
+        "extensible": "immutableActionsDataModel"
+      },
+      "data": [
+        ["actions/checkout"],
+        ["actions/cache"],
+        ["actions/setup-node"],
+        ["actions/upload-artifact"],
+        ["actions/setup-python"],
+        ["actions/download-artifact"],
+        ["actions/github-script"],
+        ["actions/setup-java"],
+        ["actions/setup-go"],
+        ["actions/upload-pages-artifact"],
+        ["actions/deploy-pages"],
+        ["actions/setup-dotnet"],
+        ["actions/stale"],
+        ["actions/labeler"],
+        ["actions/create-github-app-token"],
+        ["actions/configure-pages"],
+        ["github/codeql-action/analyze"],
+        ["github/codeql-action/autobuild"],
+        ["github/codeql-action/init"],
+        ["github/codeql-action/resolve-environment"],
+        ["github/codeql-action/start-proxy"],
+        ["github/codeql-action/upload-sarif"],
+        ["octokit/request-action"]
+      ]
+    }
+  ]
+}
@@ -11,4 +11,5 @@ extensionTargets:
   # bump the major version to 2.
   codeql/actions-all: ">=0.4.3 <2.0.0"
 dataExtensions:
-- ext/**/*.yml
+  - ext/**/*.yml
+  - ext/**/*.json
@@ -0,0 +1,49 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/actions-all",
+        "extensible": "actionsPermissionsDataModel"
+      },
+      "data": [
+        ["actions/checkout", "contents: read"],
+        ["actions/setup-node", "contents: read"],
+        ["actions/setup-python", "contents: read"],
+        ["actions/setup-java", "contents: read"],
+        ["actions/setup-go", "contents: read"],
+        ["actions/setup-dotnet", "contents: read"],
+        ["actions/labeler", "contents: read"],
+        ["actions/labeler", "pull-requests: write"],
+        ["actions/attest", "id-token: write"],
+        ["actions/attest", "attestations: write"],
+        // No permissions needed for actions/add-to-project
+        ["actions/dependency-review-action", "contents: read"],
+        ["actions/attest-sbom", "id-token: write"],
+        ["actions/attest-sbom", "attestations: write"],
+        ["actions/stale", "contents: write"],
+        ["actions/stale", "issues: write"],
+        ["actions/stale", "pull-requests: write"],
+        ["actions/attest-build-provenance", "id-token: write"],
+        ["actions/attest-build-provenance", "attestations: write"],
+        ["actions/deploy-pages", "pages: write"],
+        ["actions/deploy-pages", "id-token: write"],
+        ["actions/delete-package-versions", "packages: write"],
+        ["actions/jekyll-build-pages", "contents: read"],
+        ["actions/jekyll-build-pages", "pages: write"],
+        ["actions/jekyll-build-pages", "id-token: write"],
+        ["actions/publish-action", "contents: write"],
+        ["actions/versions-package-tools", "contents: read"],
+        ["actions/versions-package-tools", "actions: read"],
+        ["actions/reusable-workflows", "contents: read"],
+        ["actions/reusable-workflows", "actions: read"],
+        ["actions/ai-inference", "contents: read"],
+        ["actions/ai-inference", "models: read"]
+      ]
+    }
+  ]
+}
+// TODO: Add permissions for actions/download-artifact
+// TODO: Add permissions for actions/upload-artifact
+// No permissions needed for actions/upload-pages-artifact
+// TODO: Add permissions for actions/cache
+// No permissions needed for actions/configure-pages
@@ -0,0 +1,21 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/actions-all",
+        "extensible": "argumentInjectionSinksDataModel"
+      },
+      // https://gtfobins.github.io/
+      // https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection/argument-injection
+      "data": [
+        ["(awk)\\s(.*?)", 1, 2],
+        ["(find)\\s(.*?)", 1, 2],
+        ["(git clone)\\s(.*?)", 1, 2],
+        ["(sed)\\s(.*?)", 1, 2],
+        ["(tar)\\s(.*?)", 1, 2],
+        ["(wget)\\s(.*?)", 1, 2],
+        ["(zip)\\s(.*?)", 1, 2]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,63 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/actions-all",
+        "extensible": "contextTriggerDataModel"
+      },
+      "data": [
+        ["commit_comment", "github.event.comment"],
+        ["commit_comment", "github.event.changes"],
+        ["discussion", "github.event.discussion"],
+        ["discussion", "github.event.changes"],
+        ["discussion_comment", "github.event.comment"],
+        ["discussion_comment", "github.event.discussion"],
+        ["discussion_comment", "github.event.changes"],
+        ["issues", "github.event.issue"],
+        ["issues", "github.event.changes"],
+        ["issue_comment", "github.event.issue"],
+        ["issue_comment", "github.event.comment"],
+        ["issue_comment", "github.event.changes"],
+        ["gollum", "github.event.pages"],
+        ["gollum", "github.event.changes"],
+        ["pull_request_comment", "github.event.comment"],
+        ["pull_request_comment", "github.event.pull_request"],
+        ["merge_group", "github.event.merge_group"],
+        ["pull_request_comment", "github.head_ref"],
+        ["pull_request_comment", "github.event.changes"],
+        ["pull_request_review", "github.event.pull_request"],
+        ["pull_request_review", "github.event.review"],
+        ["pull_request_review", "github.head_ref"],
+        ["pull_request_review", "github.event.changes"],
+        ["pull_request_review_comment", "github.event.comment"],
+        ["pull_request_review_comment", "github.event.pull_request"],
+        ["pull_request_review_comment", "github.event.review"],
+        ["pull_request_review_comment", "github.head_ref"],
+        ["pull_request_review_comment", "github.event.changes"],
+        ["pull_request", "github.event.pull_request"],
+        ["pull_request", "github.head_ref"],
+        ["pull_request", "github.event.changes"],
+        ["pull_request_target", "github.event.pull_request"],
+        ["pull_request_target", "github.head_ref"],
+        ["pull_request_target", "github.event.changes"],
+        ["push", "github.event.commits"],
+        ["push", "github.event.head_commit"],
+        ["push", "github.event.changes"],
+        ["workflow_run", "github.event.workflow"],
+        ["workflow_run", "github.event.workflow_run"],
+        ["workflow_run", "github.event.changes"],
+        // workflow_call receives the same event payload as the calling workflow
+        ["workflow_call", "github.event.comment"],
+        ["workflow_call", "github.event.discussion"],
+        ["workflow_call", "github.event.inputs"],
+        ["workflow_call", "github.event.issue"],
+        ["workflow_call", "github.event.pages"],
+        ["workflow_call", "github.event.pull_request"],
+        ["workflow_call", "github.event.review"],
+        ["workflow_call", "github.event.workflow"],
+        ["workflow_call", "github.event.workflow_run"],
+        ["workflow_call", "github.event.changes"]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,11 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/actions-all",
+        "extensible": "enabledDeploymentEnvironmentDataModel"
+      },
+      "data": []
+    }
+  ]
+}
@@ -0,0 +1,27 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/actions-all",
+        "extensible": "externallyTriggerableEventsDataModel"
+      },
+      "data": [
+        ["discussion"],
+        ["discussion_comment"],
+        ["fork"],
+        ["watch"],
+        ["issue_comment"],
+        ["issues"],
+        ["pull_request_comment"],
+        ["pull_request_review"],
+        ["pull_request_review_comment"],
+        ["pull_request"],
+        ["pull_request_target"],
+        ["workflow_run"], // depending on branch filter
+        ["workflow_call"], // depending on caller
+        ["workflow_dispatch"],
+        ["schedule"]
+      ]
+    }
+  ]
+}