Skip to content

Commit e6e1704

Browse files
author
Alvaro Muñoz
committed
Update tests
1 parent 922ae57 commit e6e1704

8 files changed

Lines changed: 1849 additions & 60 deletions

File tree

‎ql/test/library-tests/test.expected‎

Lines changed: 1739 additions & 2 deletions
Large diffs are not rendered by default.

‎ql/test/library-tests/test.ql‎

Lines changed: 0 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,6 @@ query predicate extJobs(ExternalJob s) { any() }
2121

2222
query predicate steps(Step s) { any() }
2323

24-
query predicate runSteps(Run run, string body) { run.getScript() = body }
25-
2624
query predicate runExprs(Run s, Expression e) { e = s.getAnScriptExpr() }
2725

2826
query predicate uses(Uses s) { any() }
@@ -59,8 +57,6 @@ query predicate summaries(
5957
actionsSummaryModel(action, version, input, output, kind, provenance)
6058
}
6159

62-
query predicate calls(DataFlow::CallNode call, string callee) { callee = call.getCallee() }
63-
6460
query predicate needs(DataFlow::Node e) { e.asExpr() instanceof NeedsExpression }
6561

6662
query string testNormalizeExpr(string s) {
@@ -86,57 +82,6 @@ query predicate writeToGitHubEnv1(string content) {
8682
)
8783
}
8884

89-
query predicate writeToGitHubEnv(string key, string value, string content) {
90-
exists(string t |
91-
t =
92-
[
93-
// block
94-
"{\n echo 'VAR0<<EOF'\n echo \"$TITLE\"\n echo EOF\n} >> \"$GITHUB_ENV\"\n",
95-
"{\necho 'VAR1<<EOF'\necho \"$TITLE\"\necho EOF\n} >> \"$GITHUB_ENV\"",
96-
"{\necho 'VAR2<<EOF'\necho '$ISSUE'\necho 'EOF'\n} >> \"$GITHUB_ENV\"",
97-
"FOO\n{\n echo 'VAR22<<EOF'\n ls | grep -E \"*.(tar.gz|zip)$\"\n echo EOF\n } >> \"$GITHUB_ENV\"\nBAR",
98-
// multiline
99-
"FOO\necho \"VAR3<<EOF\" >> $GITHUB_ENV\necho \"$TITLE\" >> $GITHUB_ENV\necho \"EOF\" >> $GITHUB_ENV\nBAR",
100-
"echo \"PACKAGES_FILE_LIST<<EOF\" >> \"${GITHUB_ENV}\"\nls | grep -E \"*.(tar.gz|zip)$\" >> \"${GITHUB_ENV}\"\nls | grep -E \"*.(txt|md)$\" >> \"${GITHUB_ENV}\"\necho \"EOF\" >> \"${GITHUB_ENV}\"",
101-
// heredoc 1
102-
"cat >> $GITHUB_ENV << EOL\nVAR4=${ISSUE_BODY1}\nEOL",
103-
"cat > $GITHUB_ENV << EOL\nVAR5<<DELIM\nHello\nWorld\nDELIM\nEOL",
104-
// heredoc 2
105-
"cat << EOL >> $GITHUB_ENV\nVAR6=${ISSUE_BODY3}\nEOL\n",
106-
"cat <<EOF | sed 's/l/e/g' > $GITHUB_ENV\nVAR7<<DELIM\nHello\nWorld\nDELIM\nEOF\n",
107-
"\ncat <<-EOF >> \"$GITHUB_ENV\"\nVAR8=$(echo \"FOO\")\nVAR9<<DELIM\nHello\nWorld\nDELIM\nEOF",
108-
// single line
109-
"\necho \"::set-env name=VAR10::$(<pr-id1.txt)\"",
110-
"echo '::set-env name=VAR11::$(<pr-id2.txt)'", "echo ::set-env name=VAR12::$(<pr-id3.txt)",
111-
"echo \"VAR13=$(<test-results1/sha-number)\" >> $GITHUB_ENV",
112-
"echo 'VAR14=$(<test-results2/sha-number)' >> $GITHUB_ENV",
113-
"echo VAR15=$(<test-results3/sha-number) >> $GITHUB_ENV",
114-
"echo VAR16=$(cat issue.txt | sed 's/\\r/\\n/g' | grep -ioE '\\s*[a-z0-9_-]+/[a-z0-9_-]+\\s*$' | tr -d ' ') >> $GITHUB_ENV",
115-
] and
116-
Bash::extractFileWrite(t, "GITHUB_ENV", content) and
117-
Bash::extractVariableAndValue(content, key, value)
118-
)
119-
}
120-
121-
query predicate writeToGitHubOutput(string key, string value, string content) {
122-
exists(string t |
123-
t =
124-
[
125-
"echo \"::set-output name=VAR1::$(<pr-id1.txt)\"",
126-
"echo '::set-output name=VAR2::$(<pr-id2.txt)'",
127-
"echo ::set-output name=VAR3::$(<pr-id3.txt)",
128-
"echo \"VAR4=$(<test-results1/sha-number)\" >> $GITHUB_OUTPUT",
129-
"echo 'VAR5=$(<test-results2/sha-number)' >> $GITHUB_OUTPUT",
130-
"echo VAR6=$(<test-results3/sha-number) >> $GITHUB_OUTPUT",
131-
"echo VAR7=$(<test-results4/sha-number) >> \"$GITHUB_OUTPUT\"",
132-
"echo VAR8=$(<test-results5/sha-number) >> ${GITHUB_OUTPUT}",
133-
"echo VAR9=$(<test-results6/sha-number) >> \"${GITHUB_OUTPUT}\"",
134-
] and
135-
Bash::extractFileWrite(t, "GITHUB_OUTPUT", content) and
136-
Bash::extractVariableAndValue(content, key, value)
137-
)
138-
}
139-
14085
query predicate isBashParameterExpansion(string parameter, string operator, string params) {
14186
exists(string test |
14287
test =

‎ql/test/query-tests/Security/CWE-829/.github/workflows/resolve-args.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
comment:
5+
type: string
6+
required: true
7+
outputs:
8+
SHOULD_RUN:
9+
value: ${{ jobs.resolve.outputs.SHOULD_RUN }}
10+
GIT_REF:
11+
value: ${{ jobs.resolve.outputs.GIT_REF }}
12+
jobs:
13+
resolve:
14+
runs-on: ubuntu-latest
15+
outputs:
16+
SHOULD_RUN: ${{ steps.resolve-step.outputs.SHOULD_RUN }}
17+
GIT_REF: ${{ steps.resolve-step.outputs.GIT_REF }}
18+
steps:
19+
- uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
20+
- if: github.event_name == 'workflow_run'
21+
uses: ./.github/actions/download-artifact
22+
- id: resolve-step
23+
env:
24+
ALLOWED_COMMENT: ${{ inputs.comment }}
25+
run: |
26+
if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
27+
if [[ "$(head -n 1 /tmp/artifacts/metadata.txt)" == *"$ALLOWED_COMMENT"* ]]; then
28+
echo SHOULD_RUN=true >> "$GITHUB_OUTPUT"
29+
else
30+
echo SHOULD_RUN=false >> "$GITHUB_OUTPUT"
31+
fi
32+
echo GIT_REF="$(tail -n 1 /tmp/artifacts/metadata.txt)" >> "$GITHUB_OUTPUT"
33+
else
34+
echo SHOULD_RUN=true >> "$GITHUB_OUTPUT"
35+
echo GIT_REF="" >> "$GITHUB_OUTPUT"
36+
fi

‎ql/test/query-tests/Security/CWE-829/.github/workflows/test26.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
on:
2+
schedule:
3+
- cron: '7 18 * * *'
4+
workflow_run:
5+
workflows: [Trigger]
6+
types: [completed]
7+
workflow_dispatch:
8+
jobs:
9+
resolve:
10+
if: (github.repository == 'test/test' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success')) || github.event_name == 'workflow_dispatch'
11+
uses: ./.github/workflows/resolve-args.yml
12+
with:
13+
comment: "foo"
14+
scale:
15+
permissions:
16+
id-token: write
17+
statuses: write
18+
needs: [resolve]
19+
if: needs.resolve.outputs.SHOULD_RUN == 'true'
20+
uses: ./.github/workflows/test27.yml
21+
with:
22+
git_ref: ${{ needs.resolve.outputs.GIT_REF }}

‎ql/test/query-tests/Security/CWE-829/.github/workflows/test27.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
on:
2+
workflow_dispatch:
3+
inputs:
4+
git_ref:
5+
description: ref
6+
type: string
7+
workflow_call:
8+
inputs:
9+
git_ref:
10+
type: string
11+
jobs:
12+
run:
13+
permissions:
14+
id-token: write
15+
statuses: write
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
19+
with:
20+
ref: ${{ inputs.git_ref }}
21+
- run: |
22+
./cmd

‎ql/test/query-tests/Security/CWE-829/.github/workflows/test28.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
on:
2+
pull_request_target:
3+
types: [opened, ready_for_review, synchronize, reopened, labeled, unlabeled]
4+
branches:
5+
- main
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
setup-environment:
12+
permissions:
13+
contents: write
14+
runs-on: ubuntu-latest
15+
if: ${{ !contains(github.event.pull_request.labels.*.name, 'major-update') && (github.actor == 'renovate[bot]' || contains(github.event.pull_request.labels.*.name, 'renovatebot')) }}
16+
steps:
17+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
18+
with:
19+
ref: ${{ github.head_ref }}
20+
- run: make foo

‎ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ edges
77
| .github/actions/download-artifact/action.yaml:6:7:25:4 | Uses Step | .github/actions/download-artifact/action.yaml:25:7:29:4 | Run Step |
88
| .github/actions/download-artifact/action.yaml:25:7:29:4 | Run Step | .github/actions/download-artifact/action.yaml:29:7:32:18 | Run Step |
99
| .github/actions/download-artifact/action.yaml:29:7:32:18 | Run Step | .github/workflows/artifactpoisoning91.yml:19:9:25:6 | Run Step: metadata |
10+
| .github/actions/download-artifact/action.yaml:29:7:32:18 | Run Step | .github/workflows/resolve-args.yml:22:9:36:13 | Run Step: resolve-step |
1011
| .github/reusable_workflows/TestOrg/TestRepo/.github/workflows/formal.yml:14:9:19:6 | Uses Step | .github/reusable_workflows/TestOrg/TestRepo/.github/workflows/formal.yml:19:9:25:6 | Run Step |
1112
| .github/reusable_workflows/TestOrg/TestRepo/.github/workflows/formal.yml:19:9:25:6 | Run Step | .github/reusable_workflows/TestOrg/TestRepo/.github/workflows/formal.yml:25:9:70:20 | Run Step |
1213
| .github/reusable_workflows/TestOrg/TestRepo/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | .github/reusable_workflows/TestOrg/TestRepo/.github/workflows/reusable.yml:26:9:29:7 | Run Step |
@@ -172,6 +173,9 @@ edges
172173
| .github/workflows/pr-workflow.yml:453:9:459:6 | Uses Step | .github/workflows/pr-workflow.yml:459:9:462:6 | Run Step |
173174
| .github/workflows/pr-workflow.yml:459:9:462:6 | Run Step | .github/workflows/pr-workflow.yml:462:9:463:48 | Run Step: ok |
174175
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | .github/workflows/priv_pull_request_checkout.yml:20:9:23:52 | Run Step |
176+
| .github/workflows/resolve-args.yml:19:9:20:6 | Uses Step | .github/workflows/resolve-args.yml:20:9:22:6 | Uses Step |
177+
| .github/workflows/resolve-args.yml:20:9:22:6 | Uses Step | .github/actions/download-artifact/action.yaml:6:7:25:4 | Uses Step |
178+
| .github/workflows/resolve-args.yml:20:9:22:6 | Uses Step | .github/workflows/resolve-args.yml:22:9:36:13 | Run Step: resolve-step |
175179
| .github/workflows/reusable_local.yml:23:9:26:6 | Uses Step | .github/workflows/reusable_local.yml:26:9:29:7 | Run Step |
176180
| .github/workflows/test1.yml:18:9:21:6 | Uses Step | .github/workflows/test1.yml:21:9:24:6 | Run Step |
177181
| .github/workflows/test1.yml:21:9:24:6 | Run Step | .github/workflows/test1.yml:24:9:25:39 | Run Step |
@@ -279,6 +283,8 @@ edges
279283
| .github/workflows/test25.yml:17:9:22:6 | Uses Step | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan |
280284
| .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:32:9:35:6 | Run Step |
281285
| .github/workflows/test25.yml:32:9:35:6 | Run Step | .github/workflows/test25.yml:35:9:42:53 | Run Step |
286+
| .github/workflows/test27.yml:18:9:21:6 | Uses Step | .github/workflows/test27.yml:21:9:22:16 | Run Step |
287+
| .github/workflows/test28.yml:17:9:20:6 | Uses Step | .github/workflows/test28.yml:20:9:20:22 | Run Step |
282288
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:14:9:25:6 | Run Step |
283289
| .github/workflows/test.yml:14:9:25:6 | Run Step | .github/workflows/test.yml:25:9:33:6 | Run Step |
284290
| .github/workflows/test.yml:25:9:33:6 | Run Step | .github/workflows/test.yml:33:9:37:34 | Run Step |
@@ -318,10 +324,8 @@ edges
318324
| .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone | .github/workflows/dependabot3.yml:15:9:20:6 | Uses Step | .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/dependabot3.yml:3:5:3:23 | pull_request_target | .github/workflows/dependabot3.yml |
319325
| .github/workflows/gitcheckout.yml:21:11:23:22 | Run Step | .github/workflows/gitcheckout.yml:10:11:18:8 | Run Step | .github/workflows/gitcheckout.yml:21:11:23:22 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/gitcheckout.yml:2:3:2:21 | pull_request_target | .github/workflows/gitcheckout.yml |
320326
| .github/workflows/label_trusted_checkout2.yml:17:7:21:4 | Run Step | .github/workflows/label_trusted_checkout2.yml:12:7:16:4 | Uses Step | .github/workflows/label_trusted_checkout2.yml:17:7:21:4 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/label_trusted_checkout2.yml:2:3:2:21 | pull_request_target | .github/workflows/label_trusted_checkout2.yml |
321-
| .github/workflows/level0.yml:107:9:112:2 | Run Step | .github/workflows/level0.yml:99:9:103:6 | Uses Step | .github/workflows/level0.yml:107:9:112:2 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/level0.yml:3:3:3:8 | issues | .github/workflows/level0.yml |
322327
| .github/workflows/level0.yml:107:9:112:2 | Run Step | .github/workflows/level0.yml:99:9:103:6 | Uses Step | .github/workflows/level0.yml:107:9:112:2 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/level0.yml:5:3:5:15 | issue_comment | .github/workflows/level0.yml |
323328
| .github/workflows/level0.yml:107:9:112:2 | Run Step | .github/workflows/level0.yml:99:9:103:6 | Uses Step | .github/workflows/level0.yml:107:9:112:2 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/level0.yml:7:3:7:21 | pull_request_target | .github/workflows/level0.yml |
324-
| .github/workflows/level0.yml:133:9:135:23 | Run Step | .github/workflows/level0.yml:125:9:129:6 | Uses Step | .github/workflows/level0.yml:133:9:135:23 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/level0.yml:3:3:3:8 | issues | .github/workflows/level0.yml |
325329
| .github/workflows/level0.yml:133:9:135:23 | Run Step | .github/workflows/level0.yml:125:9:129:6 | Uses Step | .github/workflows/level0.yml:133:9:135:23 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/level0.yml:5:3:5:15 | issue_comment | .github/workflows/level0.yml |
326330
| .github/workflows/level0.yml:133:9:135:23 | Run Step | .github/workflows/level0.yml:125:9:129:6 | Uses Step | .github/workflows/level0.yml:133:9:135:23 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/level0.yml:7:3:7:21 | pull_request_target | .github/workflows/level0.yml |
327331
| .github/workflows/poc2.yml:42:9:47:6 | Uses Step | .github/workflows/poc2.yml:37:9:42:6 | Uses Step | .github/workflows/poc2.yml:42:9:47:6 | Uses Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/poc2.yml:4:3:4:15 | issue_comment | .github/workflows/poc2.yml |
@@ -338,10 +342,10 @@ edges
338342
| .github/workflows/test7.yml:33:9:36:6 | Run Step | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:33:9:36:6 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test7.yml:4:3:4:15 | issue_comment | .github/workflows/test7.yml |
339343
| .github/workflows/test7.yml:36:9:39:6 | Run Step | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:36:9:39:6 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test7.yml:4:3:4:15 | issue_comment | .github/workflows/test7.yml |
340344
| .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test7.yml:4:3:4:15 | issue_comment | .github/workflows/test7.yml |
341-
| .github/workflows/test10.yml:25:9:30:2 | Run Step | .github/workflows/test10.yml:20:9:25:6 | Uses Step | .github/workflows/test10.yml:25:9:30:2 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test10.yml:7:3:7:19 | workflow_dispatch | .github/workflows/test10.yml |
342345
| .github/workflows/test10.yml:25:9:30:2 | Run Step | .github/workflows/test10.yml:20:9:25:6 | Uses Step | .github/workflows/test10.yml:25:9:30:2 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test10.yml:8:3:8:21 | pull_request_target | .github/workflows/test10.yml |
343346
| .github/workflows/test11.yml:90:7:93:54 | Uses Step | .github/workflows/test11.yml:84:7:90:4 | Uses Step | .github/workflows/test11.yml:90:7:93:54 | Uses Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test11.yml:5:3:5:15 | issue_comment | .github/workflows/test11.yml |
344347
| .github/workflows/test17.yml:19:15:23:58 | Uses Step | .github/workflows/test17.yml:12:15:19:12 | Uses Step | .github/workflows/test17.yml:19:15:23:58 | Uses Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test17.yml:3:5:3:16 | workflow_run | .github/workflows/test17.yml |
348+
| .github/workflows/test27.yml:21:9:22:16 | Run Step | .github/workflows/test27.yml:18:9:21:6 | Uses Step | .github/workflows/test27.yml:21:9:22:16 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/test26.yml:4:3:4:14 | workflow_run | .github/workflows/test26.yml |
345349
| .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/untrusted_checkout3.yml:4:3:4:14 | workflow_run | .github/workflows/untrusted_checkout3.yml |
346350
| .github/workflows/untrusted_checkout4.yml:35:7:41:4 | Run Step | .github/workflows/untrusted_checkout4.yml:29:7:35:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:35:7:41:4 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/untrusted_checkout4.yml:2:3:2:15 | issue_comment | .github/workflows/untrusted_checkout4.yml |
347351
| .github/workflows/untrusted_checkout4.yml:41:7:47:4 | Run Step | .github/workflows/untrusted_checkout4.yml:29:7:35:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:41:7:47:4 | Run Step | Execution of untrusted code on a privileged workflow ($@) | .github/workflows/untrusted_checkout4.yml:2:3:2:15 | issue_comment | .github/workflows/untrusted_checkout4.yml |

‎ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
| .github/workflows/artifactpoisoning81.yml:11:9:14:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
2+
| .github/workflows/dependabot2.yml:33:9:38:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
3+
| .github/workflows/mend.yml:22:9:29:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
24
| .github/workflows/poc3.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
35
| .github/workflows/poc.yml:30:9:36:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
6+
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
47
| .github/workflows/test3.yml:28:9:33:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
58
| .github/workflows/test4.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
69
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |

0 commit comments

Comments
 (0)