Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: github/codeql
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: jessehouwing/codeql
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: immutable-releases-reference-implementation
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 11 files changed
  • 2 contributors

Commits on Sep 24, 2026

  1. Add per-tag immutable-release support for actions/unpinned-tag 

    Adds a new immutableActionRefsDataModel(action, ref) extensible predicate,
keyed on the normalized owner/repo plus tag, instead of the old static
repo-level immutableActionsDataModel allow-list. GitHub's Immutable
Releases feature grants immutability per tag/release, not per
repository, so a repo-level allow-list can never be accurate.

- New UseOfVersionedImmutableActionRef.qll library predicate/class,
  normalizing owner/repo/subpath refs to owner/repo before lookup.
- UnpinnedActionsTag.ql excludes matches via this new predicate,
  mutually exclusive with (and independent of) the existing
  isImmutableAction exclusion.
- New utility query actions/ql/src/utils/ListUnpinnedActionRefs.ql that
  leverages the Actions extractor itself to enumerate distinct,
  normalized (owner/repo, ref) candidates for external verification.
- Tests covering repo-level match, sub-directory match, wrong-tag, and
  unrelated-repo cases.
- Docs update describing the new predicate and normalization semantics.

See #22674 for the full proposal and end-to-end validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
    @jessehouwing
    jessehouwing and Copilot committed Sep 24, 2026
    Configuration menu
    Copy the full SHA
    74e5b3f View commit details
    Browse the repository at this point in the history
Loading