robojerk/codeql-action

Add query to find context variables that may not work with default setup

Browse source
This commit is contained in:
Henry Mercer 2023-05-12 19:35:08 +01:00
parent abb267d186
commit 8065746a2a
2 changed files with 72 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
queries/default-setup-environment-variables.ql
View file

@ -14,6 +14,8 @@ predicate isSafeForDefaultSetup(string envVar) {
envVar.matches("CODEQL_%") or
envVar.matches("CODESCANNING_%") or
envVar.matches("LGTM_%") or
// We flag up usage of potentially unsafe parts of the GitHub event in `default-setup-event-context.ql`.
envVar = "GITHUB_EVENT_PATH" or
// The following environment variables are known to be safe for use with default setup
envVar =
[