Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: github/codeql-action
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: jessehouwing/codeql-action
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: immutable-releases-reference-implementation
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 2 commits
  • 4 files changed
  • 2 contributors

Commits on Sep 24, 2026

  1. Add prototype pre-processing step for immutable Action release refs 

    Standalone composite action prototype (not yet wired into init/analyze)
that supports the actions/unpinned-tag CodeQL query's new
immutableActionRefsDataModel(action, ref) extension point:

- Runs a CodeQL utility query (list-unpinned-action-refs.ql, mirrors
  actions/ql/src/utils/ListUnpinnedActionRefs.ql in github/codeql)
  against an already-created actions-language database to enumerate
  distinct, normalized (owner/repo, ref) candidates that aren't already
  pinned to a commit SHA.
- Filters to version-like tags and checks each via the REST endpoint
  GET /repos/{owner}/{repo}/releases/tags/{ref}, reading the immutable
  boolean directly from the response.
- Emits a CodeQL data extension YAML containing only the (action, ref)
  pairs confirmed immutable, defaulting to 'mutable' (still flagged) for
  anything not found - fail-safe, no manual allow-list to maintain.

Validated end-to-end against a real repository/tag
(jessehouwing/azdo-marketplace@v6.3.8, confirmed immutable via live
API) vs. a mutable floating tag (@v6) and vs. actions/checkout@v4, and
by feeding the generated extension into the real UnpinnedActionsTag.ql
query before/after.

See github/codeql#22674 for the full proposal and validation story.

Not yet integrated into the production init/analyze steps; see that
issue for remaining integration work (model-packs input, rate limiting,
caching, tests).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
    @jessehouwing
    jessehouwing and Copilot committed Sep 24, 2026
    Configuration menu
    Copy the full SHA
    de6add0 View commit details
    Browse the repository at this point in the history

  2. Fix two bugs in the immutable-action-refs prepare script 

    - Remove the semver-shape pre-filter: a GitHub Release can be published
  against a tag of ANY name (e.g. 'stable', 'release-2024-01', even
  'latest' or 'main'), and that release can be immutable regardless of
  whether the tag looks like a semantic version. The REST lookup is the
  actual source of truth and simply 404s for refs that turn out to be
  branches or have no matching release, so no pre-filtering is needed
  or correct.
- Strip trailing carriage returns from the CodeQL-produced TSV before
  reading action/ref pairs: on Windows, jq.exe's own line output can
  carry a trailing \r that got appended to the ref value (e.g.
  'v6.3.8\r'), silently breaking every REST lookup and reporting 0
  immutable refs found. Confirmed by direct API calls succeeding
  outside the script while the script itself returned 'false' for all
  candidates.

Re-validated against jessehouwing/azdo-marketplace@v6.3.8 (immutable),
@v6 and @main (both correctly excluded, no matching release), and
actions/checkout@v4 (no matching release under that tag name).
    @jessehouwing
    jessehouwing committed Sep 24, 2026
    Configuration menu
    Copy the full SHA
    bd1cf10 View commit details
    Browse the repository at this point in the history
Loading