Actions: consume extracted lockfile pins

Author: nodeselector

actions/ql/lib/change-notes/2026-07-09-pinned-by-lockfile.md

@@ -2,4 +2,4 @@
 category: feature
 ---
 * GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
-  provides access to their YAML abstract syntax trees.
+  provides access to their YAML abstract syntax trees and valid v0.0.2 workflow pins.

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -7,4 +7,38 @@ private import codeql.actions.ast.internal.Yaml
 /** An `actions.lock` file. */
 class ActionsLock extends YamlDocument {
   ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
+
+  /**
+   * Holds if the v0.0.2 lockfile records `nwo` at `ref` for `workflowPath` with a full commit
+   * digest. Repository pins also cover sub-actions such as `actions/cache/save`.
+   */
+  bindingset[nwo]
+  predicate pins(string workflowPath, string nwo, string ref) {
+    this.getFile().getRelativePath() = ".github/workflows/actions.lock" and
+    exists(
+      YamlMapping root, YamlSequence workflowPins, YamlScalar pinNode, YamlMapping dependency,
+      string pin, string pinnedNwo
+    |
+      root = this and
+      root.lookup("version").(YamlScalar).getValue() = "v0.0.2" and
+      root.lookup("workflows").(YamlMapping).lookup(workflowPath) = workflowPins and
+      workflowPins.getElement(_) = pinNode and
+      pin = pinNode.getValue() and
+      pinnedNwo = pin.regexpCapture("^([^/@:]+/[^/@:]+)@([^:]+)$", 1) and
+      ref = pin.regexpCapture("^([^/@:]+/[^/@:]+)@([^:]+)$", 2) and
+      pinnedNwo = pinnedNwo.toLowerCase() and
+      (
+        nwo.toLowerCase() = pinnedNwo
+        or
+        nwo.toLowerCase().prefix(pinnedNwo.length() + 1) = pinnedNwo + "/"
+      ) and
+      root.lookup("dependencies").(YamlMapping).lookup(pin) = dependency and
+      dependency.lookup("ref").(YamlScalar).getValue() = ref and
+      dependency
+          .lookup("commit")
+          .(YamlScalar)
+          .getValue()
+          .regexpMatch("^(sha1-[A-Fa-f0-9]{40}|sha256-[A-Fa-f0-9]{64})$")
+    )
+  }
 }

actions/ql/lib/codeql/actions/Lock.qll

@@ -135,26 +135,6 @@ predicate trustedActionsOwnerDataModel(string owner) {
   Extensions::trustedActionsOwnerDataModel(owner)
 }
 
-/**
- * MaD models for `uses` references pinned by the repository's Actions lockfile
- * (`.github/workflows/actions.lock`).
- * Fields:
- *    - workflow_path: repo-relative path of the file containing the `uses:` reference
- *    - nwo: referenced action, optionally including a sub-action path (e.g. `actions/cache/save`)
- *    - ref: the ref as written in `uses:` (e.g. `v4`)
- */
-bindingset[nwo]
-predicate pinnedByLockfileDataModel(string workflow_path, string nwo, string ref) {
-  exists(string pinnedNwo |
-    Extensions::pinnedByLockfileDataModel(workflow_path, pinnedNwo, ref) and
-    (
-      nwo.toLowerCase() = pinnedNwo
-      or
-      nwo.toLowerCase().prefix(pinnedNwo.length() + 1) = pinnedNwo + "/"
-    )
-  )
-}
-
 /**
  * MaD models for untrusted git commands
  * Fields:

actions/ql/lib/codeql/actions/config/Config.qll

@@ -68,23 +68,6 @@ extensible predicate immutableActionsDataModel(string action);
  */
 extensible predicate trustedActionsOwnerDataModel(string owner);
 
-/**
- * Holds if the `uses` reference `nwo`@`ref` in the workflow or composite action file at
- * `workflow_path` is pinned by an entry in the repository's Actions lockfile
- * (`.github/workflows/actions.lock`).
- *
- * Supply rows from a model pack generated with the canonical parser at
- * `github.com/github/actions-lockfile/go/pkg/lockfile`. Each lockfile entry binds an `nwo`@`ref`
- * to a verified commit SHA. Without such a model pack this predicate is empty.
- *
- * Fields:
- *  - `workflow_path`: repo-relative path of the file containing the `uses:` reference,
- *    e.g. `.github/workflows/ci.yml`.
- *  - `nwo`: canonical owner and repository from the lockfile pin, e.g. `actions/cache`.
- *  - `ref`: the ref (tag or branch) as written in `uses:`, e.g. `v4`.
- */
-extensible predicate pinnedByLockfileDataModel(string workflow_path, string nwo, string ref);
-
 /**
  * Holds for git commands that may introduce untrusted data when called on an attacker controlled branch.
  */

actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

@@ -64,7 +64,9 @@ where
   not isSelfRepository(nwo) and
   not exists(UsesStep step |
     uses = step and
-    pinnedByLockfileDataModel(step.getLocation().getFile().getRelativePath(), nwo, version)
+    exists(ActionsLock lock |
+      lock.pins(step.getLocation().getFile().getRelativePath(), nwo, version)
+    )
   ) and
   not (
     if uses instanceof UsesStep and isContainerImage(nwo)

actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `actions/unpinned-tag` query no longer reports `uses:` references recorded by the new `pinnedByLockfileDataModel` extensible predicate. Lockfile pins match repository sub-actions while preserving ref casing.
+* The `actions/unpinned-tag` query no longer reports action references pinned by a valid v0.0.2 `.github/workflows/actions.lock` entry for the enclosing workflow.

actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md

@@ -11,5 +11,4 @@ extractor: actions
 tests: .
 warnOnImplicitThis: true
 dataExtensions:
-  - query-tests/Security/CWE-829/*.model.yml
   - output-clobbering.model.yml

actions/ql/test/qlpack.yml

@@ -0,0 +1,30 @@
+version: v0.0.2
+workflows:
+  .github/workflows/rust-ci.yml:
+    - dtolnay/rust-toolchain@v1
+    - mismatched/action@v1
+    - malformed/action@v1
+    - missing/action@v1
+  .github/workflows/other.yml:
+    - other-workflow/action@v1
+dependencies:
+  dtolnay/rust-toolchain@v1:
+    ref: v1
+    commit: sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
+    owner_id: 1940490
+    repo_id: 260749683
+  other-workflow/action@v1:
+    ref: v1
+    commit: sha1-1111111111111111111111111111111111111111
+    owner_id: 1
+    repo_id: 2
+  mismatched/action@v1:
+    ref: V1
+    commit: sha1-2222222222222222222222222222222222222222
+    owner_id: 3
+    repo_id: 4
+  malformed/action@v1:
+    ref: v1
+    commit: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
+    owner_id: 5
+    repo_id: 6

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/actions.lock

@@ -0,0 +1,16 @@
+on:
+  pull_request
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: dtolnay/rust-toolchain@v1
+    - uses: DToLnAy/RuSt-ToOlChAiN/save@v1
+    - uses: dtolnay/rust-toolchain@V1
+    - uses: other-workflow/action@v1
+    - uses: mismatched/action@v1
+    - uses: malformed/action@v1
+    - uses: missing/action@v1
+  reusable:
+    uses: dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1