Merge branch 'main' into rust/force-stable-toolchain

Author: paldepind

MODULE.bazel

@@ -240,11 +240,13 @@ use_repo(
     swift,
     "swift_toolchain",
     "swift_toolchain_ubuntu22.04",
+    "swift_toolchain_ubuntu22.04-aarch64",
     "swift_toolchain_xcode",
 )
 
 register_toolchains(
     "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04",
+    "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04-aarch64",
     "@swift_toolchain//:swift_toolchain_exec_xcode",
     dev_dependency = True,
 )
@@ -279,6 +281,7 @@ use_repo(
     "kotlin-compiler-2.3.0",
     "kotlin-compiler-2.3.20",
     "kotlin-compiler-2.4.0",
+    "kotlin-compiler-2.4.20",
     "kotlin-compiler-embeddable-1.8.0",
     "kotlin-compiler-embeddable-1.9.0-Beta",
     "kotlin-compiler-embeddable-1.9.20-Beta",
@@ -291,6 +294,7 @@ use_repo(
     "kotlin-compiler-embeddable-2.3.0",
     "kotlin-compiler-embeddable-2.3.20",
     "kotlin-compiler-embeddable-2.4.0",
+    "kotlin-compiler-embeddable-2.4.20",
     "kotlin-stdlib-1.8.0",
     "kotlin-stdlib-1.9.0-Beta",
     "kotlin-stdlib-1.9.20-Beta",
@@ -303,10 +307,11 @@ use_repo(
     "kotlin-stdlib-2.3.0",
     "kotlin-stdlib-2.3.20",
     "kotlin-stdlib-2.4.0",
+    "kotlin-stdlib-2.4.20",
 )
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.27.0")
+go_sdk.download(version = "1.27.1")
 
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")

actions/extractor/tools/autobuild-impl.ps1

@@ -9,7 +9,8 @@ $DefaultPathFilters = @(
     'include:.github/reusable_workflows/**/*.yml',
     'include:.github/reusable_workflows/**/*.yaml',
     'include:**/action.yml',
-    'include:**/action.yaml'
+    'include:**/action.yaml',
+    'include:**/actions.lock'
 )
 
 if ($null -ne $env:LGTM_INDEX_FILTERS) {

actions/extractor/tools/autobuild.sh

@@ -14,6 +14,7 @@ include:.github/reusable_workflows/**/*.yml
 include:.github/reusable_workflows/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
+include:**/actions.lock
 END
 )
 

actions/extractor/tools/baseline-config.json

@@ -5,6 +5,7 @@
         ".github/reusable_workflows/**/*.yml",
         ".github/reusable_workflows/**/*.yaml",
         "**/action.yml",
-        "**/action.yaml"
+        "**/action.yaml",
+        "**/actions.lock"
     ]
 }

actions/ql/integration-tests/actions-lock/query/actions.ql

@@ -0,0 +1,4 @@
+import codeql.actions.Lock
+
+from ActionsLock lock
+select lock.getFile()

actions/ql/integration-tests/actions-lock/query/qlpack.yml

@@ -0,0 +1,4 @@
+name: codeql/actions-lock-integration-test
+dependencies:
+  codeql/actions-all: "*"
+warnOnImplicitThis: true

actions/ql/integration-tests/actions-lock/src/.github/workflows/test.yml

@@ -0,0 +1,6 @@
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo test

actions/ql/integration-tests/actions-lock/src/actions.lock

@@ -0,0 +1,19 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/test.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28':
+        ref: 'v4.37.8'
+        commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
+        owner_id: 9919
+        repo_id: 259445878

actions/ql/integration-tests/actions-lock/test.py

@@ -0,0 +1,4 @@
+def test_actions_lock(codeql, actions, javascript):
+    codeql.database.create(source_root="src", language="actions")
+    output = codeql.query.run("query/actions.ql", database="test-db", _capture=True)
+    assert "actions.lock" in output

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.6.1
+
+### New Features
+
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.
+
+### Minor Analysis Improvements
+
+* Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+
 ## 0.6.0
 
 ### Breaking Changes