Repository navigation
fix: replace default CodeQL Actions scanning with advanced setup to suppress false positives - #1405
ignaciolarranaga wants to merge 2 commits into
Conversation
Switch the GitHub Actions language scanning from the default CodeQL setup to an advanced setup with a custom config that excludes the actions/artifact-poisoning query. These alerts are false positives because the flagged workflows use workflow_dispatch (requires write access), validate inputs, and use --ignore-scripts on npm commands.
| on: | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - ".github/workflows/**" | ||
| - ".github/actions/**" | ||
| - ".github/codeql/**" | ||
| pull_request: | ||
| branches: [main] | ||
| paths: | ||
| - ".github/workflows/**" | ||
| - ".github/actions/**" | ||
| - ".github/codeql/**" | ||
| schedule: | ||
| - cron: "25 14 * * 1" | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze GitHub Actions | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| security-events: write | ||
| contents: read |
There was a problem hiding this comment.
This is the broadest suppression: it completely removes the query from all scans. Any future workflow with a genuine vulnerability would go undetected. Although that's a false positive in this case, I'd prefer we tackle the alerts once detected with proper justification instead of discarding them altogether. https://docs.github.com/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolving-code-scanning-alerts
There was a problem hiding this comment.
If the concern was manual labor, it is possible to filter and dismiss multiple alerts - https://docs.github.com/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolving-code-scanning-alerts#dismissing-multiple-alerts-at-once
Summary
.github/codeql/codeql-config.yml) that excludes theactions/artifact-poisoningquery, which produces false positives onworkflow_dispatchworkflows.github/workflows/codeql-actions.yml) that scans only theactionslanguage using the custom configWhy these alerts are false positives
The
actions/artifact-poisoning/criticalrule flagsnpm install,npm pack, andnpm runcommands inworkflow_dispatch-triggered workflows. However, these are not exploitable because:workflow_dispatchrequires write access — only trusted collaborators can trigger these workflows (unlikepull_request_targetorissue_comment)packageinput matches^@qvac/before proceeding--ignore-scriptsis used —npm installandnpm packcommands use--ignore-scriptsto prevent execution of lifecycle scriptsThis matches the assessment applied when dismissing similar alerts in
integration-test-qvac-lib-infer-nmtcpp.ymlandintegration-mobile-test-qvac-lib-infer-nmtcpp.yml.Post-merge action required
After merging this PR, remove
actionsfrom the default CodeQL setup to avoid duplicate scanning:The other three languages (C/C++, JavaScript/TypeScript, Python) should remain on the default setup.
Test plan
CodeQL: GitHub Actionsworkflow runs successfully on this PRactionsfrom the default setup as described aboveMade with Cursor