{"id":4876,"date":"2026-08-20T16:16:24","date_gmt":"2026-08-20T16:16:24","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/20\/github-sharpens-codeqls-eye-on-actions-workflows-and-modern-javascript\/"},"modified":"2026-08-20T16:16:24","modified_gmt":"2026-08-20T16:16:24","slug":"github-sharpens-codeqls-eye-on-actions-workflows-and-modern-javascript","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/20\/github-sharpens-codeqls-eye-on-actions-workflows-and-modern-javascript\/","title":{"rendered":"GitHub Sharpens CodeQL\u2019s Eye on Actions Workflows and Modern JavaScript"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

GitHub Actions pipelines have become one of the quieter attack surfaces in software development. They pull in third-party actions, cache dependencies, and pass secrets between jobs, often without anyone reviewing the workflow file as closely as they\u2019d review application code. That gap is exactly where cache-poisoning and output-clobbering attacks live, and it\u2019s why GitHub keeps tuning CodeQL\u2019s ability to spot them.<\/span><\/p>\n

CodeQL 2.26.3, released August 12 and detailed in GitHub\u2019s changelog on August 19, focuses squarely on that problem. The update refines several GitHub Actions security queries and expands JavaScript and TypeScript modeling, with a particular focus on Vue applications.<\/span><\/p>\n

The release keeps CodeQL\u2019s default security suite at 497 queries covering 170 CWE categories, with an extended suite adding another 131 queries across 32 more CWEs. That scope matters less than the accuracy of individual queries, though, which is where most of this release\u2019s effort went.<\/span><\/p>\n

The Actions-focused changes are practical rather than flashy. The output-clobbering query now delivers messages tailored to the specific output channel it flags, and it no longer flags simple jq path filters when their output remains JSON-encoded, which should reduce<\/span> noisy false positives. GitHub also fixed a performance issue in that query caused by unescaped source-code input in a regular expression.<\/span><\/p>\n

Cache-poisoning and untrusted-checkout queries got a workflow improvement of their own: alert paths now start at the expressions that control untrusted checkouts, so the alert message links directly to the code responsible instead of pointing upstream and leaving the reader to trace it back. The cache-poisoning queries now also account for read-only cache access in low-trust triggers, which should reduce alerts for workflows that can\u2019t actually poison a cache even if they touch one.<\/span><\/p>\n

\u201cWorkflow files are production code that nobody reviews like production code,\u201d said Mitch Ashley, an analyst with Futurum Group. \u201cPlatform teams inherit the fallout when a poisoned cache reaches a build. Sharper alerts matter more than query count, because triage runs out first.\u201d<\/span><\/p>\n

Two other fixes matter for teams securing their CI\/CD pipelines. CodeQL now correctly classifies the <\/span>schedule<\/span> event when it determines whether a workflow is externally triggerable, and the environment-variable injection query requires that an untrusted source and a privileged context originate from the same trigger event before it flags a risk. Both changes are aimed at the same goal: fewer alerts that don\u2019t reflect real exposure, so security teams spend less time triaging noise.<\/span><\/p>\n

There\u2019s also a breaking change worth flagging. GitHub removed the <\/span>codeql.actions.security.SelfHostedQuery<\/span> module because it couldn\u2019t reliably distinguish self-hosted runners from GitHub-hosted ones based on labels alone. Teams that built custom queries on top of that module will need to adjust.<\/span><\/p>\n

The JavaScript and TypeScript updates lean into how modern front-end frameworks actually move data. Vue Router\u2019s <\/span>useRoute()<\/span> is now recognized as a client-side remote flow source, and CodeQL added flow models for Vue\u2019s Composition API helpers, including <\/span>ref<\/span>, <\/span>shallowRef<\/span>, <\/span>toRef<\/span>, <\/span>reactive<\/span>, and <\/span>computed<\/span>. For teams running Vue at scale, that closes a real gap. A lot of routing and state logic in modern Vue apps runs through those exact functions, and previous CodeQL versions couldn\u2019t always trace tainted data as it moved through them.<\/span><\/p>\n

CodeQL also added support for Sails Action2 controllers, treating declared input properties as remote flow sources, and <\/span>now recognizes the <\/span>@fastify\/rate-limit<\/span> package when checking for missing rate limiting. On the modeling side, custom queries can now reference specific files using the file:<path> syntax, making it easier to define sources and sinks tied to a particular exported API rather than to <\/span>an entire package.<\/span><\/p>\n

One more JavaScript change is worth calling out for anyone running security queries against API-heavy applications: promise-wrapped client response data is now tracked into promise fulfillment values. That means CodeQL can follow tainted data through a <\/span>.then()<\/span> chain instead of losing track of it once it\u2019s wrapped in a promise, which is common in modern fetch and axios-based code.<\/span><\/p>\n

None of these changes are dramatic on their own. That\u2019s kind of the point. CodeQL\u2019s value in a CI\/CD pipeline comes from steadily closing small gaps between how code actually behaves and what a static analysis tool can see. A missed taint path through a promise chain, a mislabeled trigger event, an alert that doesn\u2019t point at the right line of a workflow file \u2014 each one is small until it\u2019s the reason a real issue slips through or a team stops trusting the tool\u2019s output.<\/span><\/p>\n

Ashley sees a bigger shift behind these incremental fixes. \u201cScanning on a schedule was built for code written at human speed,\u201d he said. \u201cAI writes faster than reviewers can absorb, which pushes security to the moment of creation. Security leaders have to make that shift this cycle.\u201d<\/span><\/p>\n

For DevOps and platform teams running CodeQL against GitHub Actions workflows, this release is worth a routine update rather than a fire drill. The exception is anyone using the removed <\/span>SelfHostedQuery<\/span> module, who should check their custom query suites before the next scan. Everyone else gets quieter, more accurate alerts on their next run, which is arguably the more valuable outcome. Static analysis tools earn trust by being right often enough that teams stop double-checking them, and this release is another step in that direction.<\/span><\/p>\n

The update deploys automatically for GitHub.com. A corresponding release for GitHub Enterprise Server is expected to follow.<\/span><\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

GitHub Actions pipelines have become one of the quieter attack surfaces in software development. They pull in third-party actions, cache […]<\/p>\n","protected":false},"author":1,"featured_media":4877,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4876"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4876\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4877"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}