Merge pull request #22173 from knewbury01/knewbury01/customize-actions-sanitizers

Add way to customize environmentCheck Actions QL

Author: michaelnebel

actions/ql/lib/change-notes/2026-07-22-environment-check-sanitizer-mad.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an enironment is no longer a sufficient sanitizer.

actions/ql/lib/codeql/actions/config/Config.qll

@@ -164,3 +164,12 @@ predicate untrustedGhCommandDataModel(string cmd_regex, string flag) {
 predicate actionsPermissionsDataModel(string action, string permission) {
   Extensions::actionsPermissionsDataModel(action, permission)
 }
+
+/**
+ * MaD models for deployment environments
+ * Fields:
+ *    - name: deployment environment name, e.g. `Public CI`
+ */
+predicate enabledDeploymentEnvironmentDataModel(string name) {
+  Extensions::enabledDeploymentEnvironmentDataModel(name)
+}

actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

@@ -88,3 +88,12 @@ extensible predicate untrustedGhCommandDataModel(string cmd_regex, string flag);
  * - see https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token for documentation of token permissions.
  */
 extensible predicate actionsPermissionsDataModel(string action, string permission);
+
+/**
+ * Holds for deployment environments that exist with `name` for a given repository.
+ * * - 'name' is the name of the environment defined.
+ *   E.g. for the deployment environment `environment: EnvironmentInRepo`, `name` is `EnvironmentInRepo`.
+ * Requires this to be externally supplied but once done can be used to
+ * toggle precision of whether that suffices or not as a control check by contributing to `EnvironmentCheck`.
+ */
+extensible predicate enabledDeploymentEnvironmentDataModel(string name);

actions/ql/lib/codeql/actions/security/ControlChecks.qll

@@ -277,6 +277,13 @@ abstract class LabelCheck extends ControlCheck {
 }
 
 class EnvironmentCheck extends ControlCheck instanceof Environment {
+  EnvironmentCheck() {
+    // if there are any custom tuples use those
+    if enabledDeploymentEnvironmentDataModel(_)
+    then enabledDeploymentEnvironmentDataModel(this.(Environment).getName())
+    else this instanceof Environment
+  }
+
   // Environment checks are not effective against any mutable attacks
   // they do actually protect against untrusted code execution (sha)
   override predicate protectsCategoryAndEvent(string category, string event) {

actions/ql/lib/ext/config/deployment_environment.yml

@@ -0,0 +1,5 @@
+extensions:
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: enabledDeploymentEnvironmentDataModel
+    data: []

actions/ql/test/library-tests/basic/.github/workflows/controlcheck.yml

@@ -0,0 +1,16 @@
+on:
+  pull_request_target:
+    types: [Created]
+jobs:
+  test1:
+    environment: EnvironmentInRepo
+    runs-on: ubuntu-latest
+    steps:
+      - name: Test 1
+        run: echo "test1"
+  test2:
+    environment: EnvironmentNotInRepo
+    runs-on: ubuntu-latest
+    steps:
+      - name: Test 2
+        run: echo "test2"

actions/ql/test/library-tests/basic/commands.expected

@@ -16,6 +16,8 @@
 | .github/workflows/commands.yml:28:9:31:2 | Run Step | wc -l |
 | .github/workflows/commands.yml:34:9:37:6 | Run Step | command1 |
 | .github/workflows/commands.yml:34:9:37:6 | Run Step | command2 |
+| .github/workflows/controlcheck.yml:9:9:11:2 | Run Step | echo "test1" |
+| .github/workflows/controlcheck.yml:15:9:16:25 | Run Step | echo "test2" |
 | .github/workflows/expression_nodes.yml:7:9:8:6 | Run Step | LINE 1echo '${{ github.event.comment.body }}' |
 | .github/workflows/expression_nodes.yml:8:9:10:6 | Run Step | LINE 1 echo '${{ github.event.comment.body }}' |
 | .github/workflows/expression_nodes.yml:10:9:13:6 | Run Step | LINE 1 echo '${{ github.event.comment.body }}' |

actions/ql/test/library-tests/basic/controlchecktest.expected

@@ -0,0 +1 @@
+| .github/workflows/controlcheck.yml:6:18:6:34 | EnvironmentInRepo |

actions/ql/test/library-tests/basic/controlchecktest.ext.yml

@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: enabledDeploymentEnvironmentDataModel
+    data: 
+      # assumed to exist in a repo where controlcheck.yml exists
+      # realistically would need to be manually/externally provided
+      - ["EnvironmentInRepo"]

actions/ql/test/library-tests/basic/controlchecktest.ql

@@ -0,0 +1,5 @@
+import actions
+import codeql.actions.security.ControlChecks
+
+from ControlCheck c
+select c