Add query to detect use of actions libs #151
Conversation
chrisgavin
left a comment
chrisgavin
left a comment
There was a problem hiding this comment.
I don't think it's essential to resolve now, but just to check my understanding, am I right in thinking that so long as a use of an Actions library is guarded on one call path, it will be considered guarded on all of them?
Might make sense to add a global logger at some point so we don't have to pass it around.
Partially. You're right it only checks for the existance of one guard instead of making sure that all paths are covered, however we're also looking at individual |
Makes sense to me. I think it should work ok too as we can make a very good guess of whether we're in actions mode or CLI mode by looking at the env vars, so we should be able to create a logged of the right type on demand. |
Since some of the code now needs to run flawlessly outside of actions, I think a CodeQL query will be really helpful for spotting accidental uses.
This borrows a lot of the framework from undeclared-action-input.ql but adds in checks for guards that we are running in actions/cli mode.
This finds a few cases, which I've fixed in this PR. I've pushed a branch without the fixes too so you can see what the alerts were at https://github.com/github/codeql-action/security/code-scanning?query=ref%3Arefs%2Fheads%2Faction_libs_query_alerts
Merge / deployment checklist