Actions queries for CodeQL analysis

Explore the queries that CodeQL uses to analyze code written in GitHub Actions workflow files when you select the default or the security-extended query suite.

谁可以使用此功能？

CodeQL 可用于以下存储库类型：

GitHub.com 上的公共存储库，请参阅 GitHub CodeQL 条款和条件
启用了 GitHub Code Security 的 GitHub Team 或 GitHub Enterprise Cloud 上的组织拥有的存储库

CodeQL includes many queries for analyzing GitHub Actions workflows. 默认情况下，default 查询套件中的所有查询都会运行。如果选择使用 security-extended 查询套件，则会运行其他查询。有关详细信息，请参阅“CodeQL 查询套件”。

Built-in queries for GitHub Actions analysis

下表列出了最新版本的 CodeQL 操作和 CodeQL CLI 的可用查询。有关详细信息，请参阅 CodeQL 文档中的 CodeQL 更改日志。

Query name	Related CWEs	Default	Extended	Copilot Autofix
Artifact poisoning	829
Cache Poisoning via caching of untrusted files	349
Cache Poisoning via execution of untrusted code	349
Cache Poisoning via low-privileged code injection	349, 094
Checkout of untrusted code in a privileged context	829
Checkout of untrusted code in trusted context	829
Code injection	094, 095, 116
Environment variable built from user-controlled sources	077, 020
Excessive Secrets Exposure	312
Improper Access Control	285
PATH environment variable built from user-controlled sources	077, 020
Storage of sensitive information in GitHub Actions artifact	312
Unmasked Secret Exposure	312
Untrusted Checkout TOCTOU	367
Untrusted Checkout TOCTOU	367
Use of a known vulnerable action	1395
Workflow does not contain permissions	275
Artifact poisoning	829
Checkout of untrusted code in trusted context	829
Code injection	094, 095, 116
Environment variable built from user-controlled sources	077, 020
PATH environment variable built from user-controlled sources	077, 020
Unpinned tag for a non-immutable Action in workflow	829