• CodeQL query help documentation »

CodeQL query help for GitHub Actions

Visit the articles below to see the documentation for the queries included in the following query suites:

• default: queries run by default in CodeQL code scanning on GitHub.

• security-extended: queries from default, plus extra security queries with slightly lower precision and severity.

• security-and-quality: queries from default, security-extended, plus extra maintainability and reliability queries.

These queries are published in the CodeQL query pack codeql/actions-queries (changelog, source).

• Artifact poisoning
• Cache Poisoning in GitHub Actions
• Cache Poisoning in GitHub Actions
• Cache Poisoning in GitHub Actions
• Execution of Untrusted Checked-out Code
• Execution of Untrusted Checked-out Code
• Code Injection in GitHub Actions
• Environment Variable Injection
• Excessive Secrets Exposure
• If Condition Always Evaluates to True
• Improper Access Control
• Environment Path Injection
• Storage of sensitive information in GitHub Actions artifact
• Unmasked Secret Exposure
• Unpinned tag for 3rd party Action in workflow
• Untrusted Checkout TOCTOU (Time-of-check to time-of-use)
• Use of Actions with known vulnerabilities
• Unneccesary use of advanced configuration
• Actions Job and Workflow Permissions are not set

• © GitHub, Inc.
• Terms
• Privacy