Adding comprehensive docs for customizing actions/unpinned-tag query
#19427
+41
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This pull request adds documentation to help users customize the behavior of the UnpinnedActionsTag query by providing detailed configuration instructions and examples.
- Updated UnpinnedActionsTag.md to include a reference link to the customization guide.
- Added a new file, UnpinnedActionsTag-CUSTOMIZING.md, with step-by-step configuration instructions and examples.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md | Added reference to the customizing guide to inform users about extending the trusted Action publishers list. |
| actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md | New documentation file with configuration steps and examples for customizing trusted Action publishers. |
| ## References | ||
| - [Extending CodeQL coverage with CodeQL model packs in default setup](https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#extending-codeql-coverage-with-codeql-model-packs-in-default-setup) | ||
| - [Creating and working with CodeQL packs](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack) | ||
| - [Customizing library models for GitHub Actions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-actions/) |
There was a problem hiding this comment.
Could we have the guidance you're adding in this page https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-actions instead? I like the guidance, just prefer that location.
I ask because:
- that is the location we point to for customising in general
- it's in the public docs rather than just in our repo or the code scanning alert view
- this
-CUSTOMIZING.mdfile will be hard to discover, since it's not shipped - changing the query help
.mdfile will influence Autofix suggestions, which I'd like to avoid
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces documentation updates for customizing the behavior of the
UnpinnedActionsTagquery in CodeQL. The changes include detailed instructions on how to extend the list of trusted Action publishers and a reference link to the customization guide. Inspired by lack of visibility here: #18316 (comment)Documentation Enhancements:
Added a customization guide for trusted Action publishers:
A new section in
UnpinnedActionsTag-CUSTOMIZING.mdexplains how to configure a data extension model pack to allow specific Action publishers, preventing security alerts for unpinned tags from these publishers. This includes step-by-step instructions and example configuration files.Linked customization guide in primary documentation:
Updated
UnpinnedActionsTag.mdto include a reference to the new customization guide, helping users find the configuration instructions easily.