Merged
Conversation
greenc-FNAL
force-pushed
the
maintenance/fix-codeql-reports
branch
13 times, most recently
from
ed216f8 to
42ebc4e
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
greenc-FNAL
force-pushed
the
maintenance/fix-codeql-reports
branch
from
42ebc4e to
7ce4f6c
Compare
greenc-FNAL
force-pushed
the
maintenance/fix-codeql-reports
branch
5 times, most recently
from
8a8b8ad to
d5712b1
Compare
Contributor
|
Review the full CodeQL report for details. |
greenc-FNAL
force-pushed
the
maintenance/fix-codeql-reports
branch
5 times, most recently
from
e9a54ff to
e6754ad
Compare
Shouldn't need package permissions for a public image Try with top-level permissions block
Updates all third-party GitHub Actions used in the CI/CD workflows to their latest stable tagged versions. Each action is now pinned to a specific commit SHA to enhance security and prevent unexpected changes from future updates to the action tags. An inline comment has been added to each `uses:` line to indicate the corresponding version tag.
greenc-FNAL
force-pushed
the
maintenance/fix-codeql-reports
branch
from
e6754ad to
56fcad9
Compare
This commit addresses the `actions/untrusted-checkout/high` CodeQL alert, which flags a security vulnerability where workflows triggered by `issue_comment` could check out and execute untrusted code from a pull request in a privileged context. The following workflows have been updated to check that the comment author has a trusted association (`COLLABORATOR` or `OWNER`) before running jobs that check out external code: - .github/workflows/clang-format-fix.yaml - .github/workflows/clang-tidy-check.yaml - .github/workflows/clang-tidy-fix.yaml - .github/workflows/cmake-build.yaml - .github/workflows/cmake-format-fix.yaml This ensures that potentially malicious code from pull requests is not executed with write permissions to the repository simply by a user posting a comment.
This commit updates all workflows that use local reusable actions to instead use the versions from the `main` branch of the `Framework-R-D/phlex` repository. Pinning actions to a specific branch or commit is a security best practice that prevents pull requests from executing their own modified, potentially malicious versions of those actions. It also improves the consistency and reliability of the workflows. The following workflows were updated: - .github/workflows/clang-format-check.yaml - .github/workflows/clang-tidy-check.yaml - .github/workflows/clang-tidy-fix.yaml - .github/workflows/cmake-build.yaml - .github/workflows/cmake-format-check.yaml - .github/workflows/codeql-analysis.yaml - .github/workflows/coverage.yaml
knoepfel
approved these changes
Nov 19, 2025
greenc-FNAL
added a commit
that referenced
this pull request
Feb 13, 2026
Resolve 6 medium-severity code injection alerts (CodeQL #107, #105, #104, #103, #102, #100) in .github/actions/handle-fix-commit/action.yaml by moving user inputs to environment variables before use in shell commands. This follows GitHub Security Lab best practices for preventing code injection in GitHub Actions workflows: https://securitylab.github.com/research/github-actions-untrusted-input/ Changes: - Added env: section mapping all user inputs to environment variables - Updated shell script to use $VAR syntax instead of ${{ inputs.X }} syntax - Properly quoted all variable references to prevent word splitting Inputs affected: - inputs.token → $TOKEN - inputs.tool → $TOOL - inputs.retry-attempts → $RETRY_ATTEMPTS - inputs.pr-info-ref → $PR_REF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.