Merge branch 'main' into felickz-add-spring-r2dbc-models

Author: felickz

CODEOWNERS

@@ -24,8 +24,14 @@
 /rust/ @github/codeql-rust
 /rust/extractor/ @github/codeql-rust @github/code-scanning-language-coverage
 /shared/ @github/codeql-shared-libraries-reviewers
+/shared/cpp/ @github/code-scanning-language-coverage
+/shared/yeast/ @github/code-scanning-language-coverage
+/shared/yeast-macros/ @github/code-scanning-language-coverage
+/shared/yeast-schema/ @github/code-scanning-language-coverage
 /swift/ @github/codeql-swift
 /swift/extractor/ @github/codeql-swift @github/code-scanning-language-coverage
+/unified/extractor/ @github/code-scanning-language-coverage
+/unified/swift-syntax-rs/ @github/code-scanning-language-coverage
 /misc/codegen/ @github/codeql-swift
 /java/kotlin-extractor/ @github/codeql-kotlin @github/code-scanning-language-coverage
 /java/ql/test-kotlin1/ @github/codeql-kotlin

Cargo.lock

@@ -1,3 +1,13 @@
+## 0.5.0
+
+### Breaking Changes
+
+* The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted runners from managed runners.
+
+### Minor Analysis Improvements
+
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.
+
 ## 0.4.40
 
 ### Minor Analysis Improvements

actions/ql/lib/CHANGELOG.md

@@ -0,0 +1,9 @@
+## 0.5.0
+
+### Breaking Changes
+
+* The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted runners from managed runners.
+
+### Minor Analysis Improvements
+
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.

actions/ql/lib/change-notes/2026-07-27-merge-group-event-source.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.40
+lastReleaseVersion: 0.5.0

actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md

@@ -52,29 +52,43 @@ class GitHubCtxSource extends RemoteFlowSource {
   override string getEventName() { result = event }
 }
 
+bindingset[expression]
+pragma[inline_late]
+private predicate untrustedEventProperty(Expression expression, string kind) {
+  exists(string regexp |
+    untrustedEventPropertiesDataModel(regexp, kind) and
+    kind != "json" and
+    normalizeExpr(expression.getExpression()).regexpMatch("(?i)\\s*" + wrapRegexp(regexp) + ".*")
+  )
+}
+
+bindingset[expression, event]
+pragma[inline_late]
+private predicate expressionContainsEventContext(Expression expression, string event) {
+  exists(string contextPrefix |
+    contextTriggerDataModel(event, contextPrefix) and
+    normalizeExpr(expression.getExpression()).matches("%" + contextPrefix + "%")
+  )
+}
+
 class GitHubEventCtxSource extends RemoteFlowSource {
   string flag;
   string context;
   string event;
 
   GitHubEventCtxSource() {
-    exists(Expression e, string regexp |
+    exists(Expression e |
       this.asExpr() = e and
       context = e.getExpression() and
       (
         // the context is available for the job trigger events
         event = e.getATriggerEvent().getName() and
-        exists(string context_prefix |
-          contextTriggerDataModel(event, context_prefix) and
-          normalizeExpr(context).matches("%" + context_prefix + "%")
-        )
+        expressionContainsEventContext(e, event)
         or
         not exists(e.getATriggerEvent()) and
         event = "unknown"
       ) and
-      untrustedEventPropertiesDataModel(regexp, flag) and
-      not flag = "json" and
-      normalizeExpr(context).regexpMatch("(?i)\\s*" + wrapRegexp(regexp) + ".*")
+      untrustedEventProperty(e, flag)
     )
   }
 
@@ -177,32 +191,41 @@ class GitHubEventPathSource extends RemoteFlowSource, CommandSource {
   override Run getEnclosingRun() { result = run }
 }
 
+bindingset[expression, event]
+pragma[inline_late]
+private predicate jsonSourceForEvent(Expression expression, string event) {
+  exists(string context, string regexp, string contextPrefix |
+    context = expression.getExpression() and
+    untrustedEventPropertiesDataModel(regexp, _) and
+    contextTriggerDataModel(event, contextPrefix) and
+    normalizeExpr(context).matches("%" + contextPrefix + "%") and
+    normalizeExpr(context).regexpMatch("(?i).*" + wrapJsonRegexp(regexp) + ".*")
+  )
+  or
+  exists(string context |
+    context = expression.getExpression() and
+    untrustedEventPropertiesDataModel(_, _) and
+    contextTriggerDataModel(event, _) and
+    normalizeExpr(context).regexpMatch("(?i).*" + wrapJsonRegexp("\\bgithub.event\\b") + ".*")
+  )
+}
+
 class GitHubEventJsonSource extends RemoteFlowSource {
   string flag;
   string event;
 
   GitHubEventJsonSource() {
-    exists(Expression e, string context, string regexp |
+    exists(Expression e |
       this.asExpr() = e and
-      context = e.getExpression() and
-      untrustedEventPropertiesDataModel(regexp, _) and
       (
         // only contexts for the triggering events are considered tainted.
         // eg: for `pull_request`, we only consider `github.event.pull_request`
         event = e.getEnclosingWorkflow().getATriggerEvent().getName() and
-        exists(string context_prefix |
-          contextTriggerDataModel(event, context_prefix) and
-          normalizeExpr(context).matches("%" + context_prefix + "%")
-        ) and
-        normalizeExpr(context).regexpMatch("(?i).*" + wrapJsonRegexp(regexp) + ".*")
-        or
-        // github.event is tainted for all triggers
-        event = e.getEnclosingWorkflow().getATriggerEvent().getName() and
-        contextTriggerDataModel(e.getEnclosingWorkflow().getATriggerEvent().getName(), _) and
-        normalizeExpr(context).regexpMatch("(?i).*" + wrapJsonRegexp("\\bgithub.event\\b") + ".*")
+        jsonSourceForEvent(e, event)
         or
         not exists(e.getATriggerEvent()) and
-        event = "unknown"
+        event = "unknown" and
+        untrustedEventPropertiesDataModel(_, _)
       ) and
       flag = "json"
     )

actions/ql/lib/change-notes/released/0.5.0.md

@@ -5,8 +5,8 @@ string defaultBranchTriggerEvent() {
     [
       "check_run", "check_suite", "delete", "discussion", "discussion_comment", "fork", "gollum",
       "issue_comment", "issues", "label", "milestone", "project", "project_card", "project_column",
-      "public", "pull_request_comment", "pull_request_target", "repository_dispatch", "schedule",
-      "watch", "workflow_run"
+      "public", "pull_request_comment", "pull_request_target", "repository_dispatch",
+      "registry_package", "page_build", "schedule", "watch", "workflow_dispatch", "workflow_run"
     ]
 }
 
@@ -42,6 +42,27 @@ predicate runsOnDefaultBranch(Event e) {
   )
 }
 
+private string defaultBranchCacheWriteEvent() {
+  result =
+    [
+      "push", "workflow_dispatch", "repository_dispatch", "delete", "registry_package",
+      "page_build", "schedule"
+    ]
+}
+
+private predicate eventHasDefaultBranchCacheWriteAccess(Event event) {
+  runsOnDefaultBranch(event) and event.getName() = defaultBranchCacheWriteEvent()
+}
+
+/**
+ * Holds if `job` can write to the cache scope of the default branch for `event`.
+ * Reusable workflow jobs inherit their caller's trigger event.
+ */
+predicate hasDefaultBranchCacheWriteAccess(LocalJob job, Event event) {
+  job.getATriggerEvent() = event and
+  eventHasDefaultBranchCacheWriteAccess(event)
+}
+
 abstract class CacheWritingStep extends Step {
   abstract string getPath();
 }

actions/ql/lib/codeql-pack.release.yml

@@ -29,22 +29,10 @@ Event getRelevantCachePoisoningEventForSink(DataFlow::Node sink) {
   exists(LocalJob job |
     job = sink.asExpr().getEnclosingJob() and
     job.getATriggerEvent() = result and
-    // job can be triggered by an external user
-    result.isExternallyTriggerable() and
     // excluding privileged workflows since they can be exploited in easier circumstances
     // which is covered by `actions/code-injection/critical`
     not job.isPrivilegedExternallyTriggerable(result) and
-    (
-      // the workflow runs in the context of the default branch
-      runsOnDefaultBranch(result)
-      or
-      // the workflow caller runs in the context of the default branch
-      result.getName() = "workflow_call" and
-      exists(ExternalJob caller |
-        caller.getCallee() = job.getLocation().getFile().getRelativePath() and
-        runsOnDefaultBranch(caller.getATriggerEvent())
-      )
-    )
+    hasDefaultBranchCacheWriteAccess(job, result)
   )
 }