Merge branch 'main' into improve/actions-untrusted-checkout-source-link

Author: JarLob

Cargo.lock

@@ -9,7 +9,6 @@ members = [
     "shared/yeast-schema",
     "ruby/extractor",
     "unified/extractor",
-    "unified/extractor/tree-sitter-swift",
     "unified/swift-syntax-rs",
     "rust/extractor",
     "rust/extractor/macros",

Cargo.toml

@@ -109,7 +109,6 @@ use_repo(
     tree_sitter_extractors_deps,
     "vendor_ts__anyhow-1.0.100",
     "vendor_ts__argfile-0.2.1",
-    "vendor_ts__cc-1.2.61",
     "vendor_ts__chalk-ir-0.104.0",
     "vendor_ts__chrono-0.4.42",
     "vendor_ts__clap-4.5.48",
@@ -157,9 +156,7 @@ use_repo(
     "vendor_ts__tracing-subscriber-0.3.20",
     "vendor_ts__tree-sitter-0.26.8",
     "vendor_ts__tree-sitter-embedded-template-0.25.0",
-    "vendor_ts__tree-sitter-generate-0.26.8",
     "vendor_ts__tree-sitter-json-0.24.8",
-    "vendor_ts__tree-sitter-language-0.1.5",
     "vendor_ts__tree-sitter-python-0.23.6",
     "vendor_ts__tree-sitter-ql-0.23.1",
     "vendor_ts__tree-sitter-ruby-0.23.1",
@@ -322,7 +319,7 @@ go_sdk.download(version = "1.26.5")
 
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")
-use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_tools")
+use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_sys", "org_golang_x_tools")
 
 ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archive")
 

MODULE.bazel

@@ -1,3 +1,9 @@
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+
 ## 0.4.39
 
 No user-facing changes.

actions/ql/lib/CHANGELOG.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.

actions/ql/lib/change-notes/2026-07-27-merge-group-event-source.md

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.

…26-07-09-environment-check-alteration.md …s/ql/lib/change-notes/released/0.4.40.mdactions/ql/lib/change-notes/2026-07-09-environment-check-alteration.md renamed to actions/ql/lib/change-notes/released/0.4.40.md actions/ql/lib/change-notes/2026-07-09-environment-check-alteration.md renamed to actions/ql/lib/change-notes/released/0.4.40.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.39
+lastReleaseVersion: 0.4.40

actions/ql/lib/codeql-pack.release.yml

@@ -111,6 +111,43 @@ class WorkflowCommandClobberingFromEnvVarSink extends OutputClobberingSink {
   }
 }
 
+private string jqSafeOptionRegexp() {
+  result = "-[acCMeRnSs]+"
+  or
+  result =
+    "--(ascii-output|color-output|compact-output|exit-status|monochrome-output|null-input|" +
+      "raw-input|slurp|sort-keys|unbuffered)"
+}
+
+private string jqSimpleFilterRegexp() {
+  result = "\\."
+  or
+  result = "\\.[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*|\\[[0-9]+\\])*"
+}
+
+private string jqSimpleFilterArgumentRegexp() {
+  result = jqSimpleFilterRegexp()
+  or
+  result = "'" + jqSimpleFilterRegexp() + "'"
+  or
+  result = "\"" + jqSimpleFilterRegexp() + "\""
+}
+
+private string jqLiteralInputRegexp() {
+  result = "[A-Za-z0-9_./][A-Za-z0-9_./-]*"
+  or
+  result = "\\$GITHUB_EVENT_PATH"
+  or
+  result = "\\$\\{GITHUB_EVENT_PATH\\}"
+}
+
+bindingset[command]
+private predicate jqProducesJsonEncodedOutput(string command) {
+  command
+      .regexpMatch("jq(\\s+" + jqSafeOptionRegexp() + ")*\\s+" + jqSimpleFilterArgumentRegexp() +
+          "(\\s+" + jqSafeOptionRegexp() + ")*(\\s+" + jqLiteralInputRegexp() + ")*")
+}
+
 /**
  *      - id: clob1
  *        run: |
@@ -165,7 +202,8 @@ class WorkflowCommandClobberingFromFileReadSink extends OutputClobberingSink {
           // - run: cat pr-id.txt
           clobbering_stmt.indexOf(clobbering_cmd) = 0
         )
-      )
+      ) and
+      not jqProducesJsonEncodedOutput(clobbering_cmd)
     )
   }
 }

actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll

@@ -19,6 +19,7 @@ extensions:
       - ["gollum", "github.event.changes"] 
       - ["pull_request_comment", "github.event.comment"] 
       - ["pull_request_comment", "github.event.pull_request"] 
+      - ["merge_group", "github.event.merge_group"]
       - ["pull_request_comment", "github.head_ref"] 
       - ["pull_request_comment", "github.event.changes"] 
       - ["pull_request_review", "github.event.pull_request"] 

actions/ql/lib/ext/config/context_event_map.yml

@@ -17,4 +17,4 @@ extensions:
       - ["workflow_run"] # depending on branch filter
       - ["workflow_call"] # depending on caller
       - ["workflow_dispatch"] 
-      - ["scheduled"]
+      - ["schedule"]