Repository navigation
chore(release-prep): cleanup links in test fixtures & enforce CodeQL eligibility checks - #61
Merged
Merged
Conversation
… registry Change the References in the two ActionsLockAware query help files from gh.io/actions-lockfile, which redirects to a private early-access repo and 404s for the public, to the public GitHub Docs lockfile pages. Regenerate the corpus SARIF fixtures to pick up the new help. Set the e2e harness .npmrc to registry.npmjs.org, and regenerate package-lock.json against it so npm ci stops fetching from an internal feed. Add .gitattributes to mark the corpus fixture SARIFs linguist-generated.
data-douser
added
documentation
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 12:51
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
1 open finding
What changed in this PR
This PR introduces a “remote-source eligibility” (source policy) layer that gates remote GitHub content downloads based on best-effort evidence (public visibility, declared ownership, and security/scanning signals), and wires it through the CLI/server so retries can immediately reconsider previously refused sources.
Changes:
- Add
internal/sourcepolicypolicy engine and integrate it into catalog remote reads (files, databases, SARIF, alerts, comparisons) and git checkouts. - Add retry/refresh plumbing (store queries + server control endpoint invalidation) so operators can requeue and immediately re-evaluate source-policy refusals.
- Update docs, fixtures, and corpus metadata to reflect the new policy behavior and updated help references.
| File | Description |
|---|---|
| ui/tests/e2e/.npmrc | Forces npmjs registry for consistent lockfile resolution in e2e installs. |
| testdata/corpus/fixtures/globex-industries__legacy-pipeline/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/globex-industries__feature-flags/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/globex-industries__docs-site/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/globex-industries__deploy-scripts/findings.sarif | Regenerated SARIF fixture (marker ordering + help/version metadata). |
| testdata/corpus/fixtures/globex-industries__config-service/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/globex-industries__codeql-config/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/globex-industries__cli-wrapper/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/globex-industries__artifact-store/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/globex-industries__access-gateway/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/acme-corp__storefront/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/fixtures/acme-corp__payments/findings.sarif | Regenerated SARIF fixture (help links/version metadata). |
| testdata/corpus/authoring.json | Bumps recorded CLI version for corpus authoring. |
| ql/actions/findings/src/ActionsLockAware/UncoveredActionRef.md | Updates help references to current GitHub Actions lockfile docs. |
| ql/actions/findings/src/ActionsLockAware/ActionsLockMissingForWorkflow.md | Updates help references to current GitHub Actions lockfile docs. |
| internal/store/sourcepolicy_test.go | Adds coverage for requeueing only “source policy” unavailable rows. |
| internal/store/requeue.go | Adds store APIs to detect and requeue source-policy skipped repositories. |
| internal/store/backend.go | Extends SetupStore interface with source-policy skip/retry operations. |
| internal/sourcepolicy/policy_test.go | Adds tests for policy decisions, caching, concurrency, and cancellation. |
| internal/sourcepolicy/policy.go | Implements source-policy eligibility, memoization, and denial/warn semantics. |
| internal/serve/serve.go | Adds server hook to invalidate cached policy decisions on operator retry. |
| internal/serve/requestexamples_test.go | Ensures policy denials map to 403 (not 502) for request example reads. |
| internal/serve/requestexamples.go | Converts source-policy Denied errors into HTTP 403 responses. |
| internal/serve/discovery_test.go | Validates retry-unavailable invalidation only after control authorization. |
| internal/serve/discovery.go | Calls InvalidateSources() on authorized retry-unavailable requests. |
| internal/harness/session.go | Adds fixture guidance to anonymize/synthesize private production sources. |
| internal/harness/fixtureguidance_test.go | Tests that authoring/drafting guidance mentions anonymization requirements. |
| internal/harness/draft.go | Updates drafting instructions to avoid verbatim private production examples. |
| internal/ghapp/manifest.go | Documents new REST calls used by the eligibility checks. |
| internal/expand/sourcepolicy_test.go | Adds expansion tests ensuring policy refusals surface consistently. |
| internal/expand/requeue.go | Invalidates policy cache when operator requeues a repository. |
| internal/expand/expand.go | Adds SourcePolicy field to Expander for reuse across components. |
| internal/expand/checkout.go | Applies policy before git fetch; treats denials as “unavailable”. |
| internal/catalog/sourceaccess_test.go | Adds tests for metadata read + minimal scanning probe behavior. |
| internal/catalog/sourceaccess.go | Adds repository metadata eligibility reads + minimal scanning access probe. |
| internal/catalog/setup.go | Applies policy gate to remote file reads via contents API. |
| internal/catalog/files.go | Applies policy gate to commit-file reads. |
| internal/catalog/codescanning.go | Applies policy gate to code-scanning reads, SARIF download, compare, etc. |
| internal/catalog/client.go | Adds SourcePolicy hook on client and gates database downloads. |
| docs/deployment/source.md | Points to configuration docs for eligibility instead of legacy note. |
| docs/deployment/operations.md | Documents warnings/refusals and retry workflow for source-policy. |
| docs/deployment/index.md | Notes best-effort remote-source checks in deployment overview. |
| docs/deployment/configuration.md | Adds “Remote-source eligibility” section and related guidance. |
| cmd/codeql-abom/verifylock.go | Wires lock verification through policy-aware checkout + default policy. |
| cmd/codeql-abom/sourcepolicy_test.go | End-to-end tests validating policy prevents remote content access. |
| cmd/codeql-abom/sourcepolicy_corpus_test.go | Optional corpus-based comparison test for policy decisions. |
| cmd/codeql-abom/sourcepolicy.go | Wires policy into catalog + checkout and adds setup-triggered retry logic. |
| cmd/codeql-abom/serve.go | Wires policy into server/discovery/setup and lock verifier. |
| cmd/codeql-abom/expand.go | Ensures expand CLI wires source policy into the expander. |
| cmd/codeql-abom/discover.go | Ensures discovery client uses policy for guarded remote reads. |
| cmd/codeql-abom/codescanning.go | Wires policy into the code-scanning reader used during expansion. |
| cmd/codeql-abom/check.go | Ensures check command’s GitHub reader uses policy for guarded reads. |
| .gitattributes | Marks SARIF fixtures as generated to reduce noise in GitHub diffs. |
Files not reviewed (1)
- ui/tests/e2e/package-lock.json: Generated file
🧠 Review effort: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Add nil check for SourcePolicy before invalidating. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>
data-douser
marked this pull request as ready for review
October 16, 2026 15:22
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 15:22
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nathan Randall <70299490+data-douser@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 15:29
data-douser
added a commit
that referenced
this pull request
Oct 16, 2026
Resolve conflicts with #61, which squashed this branch's first two commits: - requeue.go: keep main's nil guard around Invalidate, after the trim. - sourcepolicy_test.go: keep this branch's copy, a strict superset of main's. - client.go: keep this branch's corrected SourcePolicy comment. - checkout.go: keep only the policy check under the checkout timeout; the textual merge kept both blocks and ran the check twice. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Prepare the "Actions Bill of Materials" project for initial public (open-source) release by:
LICENSEterms.Summary of Changes
Introduces a "source policy" enforcement mechanism to the codebase, ensuring that remote source downloads and repository access are subject to ownership and security eligibility checks. The changes affect several core components, including the server, CLI, and expansion logic, and are accompanied by new documentation and extensive tests. The main goals are to prevent unauthorized access to private repositories, provide clear evidence for source eligibility, and support robust testing and operational transparency.
Key changes include:
Source Policy Enforcement
sourcepolicy.gomodule, which defines the logic for verifying repository eligibility for remote downloads based on ownership, security configuration, and prior analyses. This includes theprotectSourcesfunction, policy binding for fetchers, and integration with repository readers and expanders.Testing and Validation
sourcepolicy_test.goandsourcepolicy_corpus_test.go, providing extensive tests for policy enforcement, including end-to-end scenarios, integration with expansion and fetchers, and regression tests against a recorded corpus. [1] [2]Documentation Updates
Codebase Integration and Refactoring
Test Data and Attributes
These changes significantly strengthen the security and compliance posture of the application by ensuring that only authorized and eligible sources are accessed, with clear operational and testing support.