Skip to content

Commit bc02699

Browse files
marcogariomchammer01saritaiaeisenberg
authored
Add Actions as supported language (#53606)
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> Co-authored-by: Sarita Iyer <66540150+saritai@users.noreply.github.com> Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>
1 parent 0a02699 commit bc02699

6 files changed

Lines changed: 35 additions & 3 deletions

File tree

‎content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,18 @@ The same principles described above for using third-party actions also apply to
224224

225225
For more information on how to configure this setting, see {% ifversion ghes or ghec %}[AUTOTITLE](/enterprise-cloud@latest/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests),{% endif %} [Disabling or limiting {% data variables.product.prodname_actions %} for your organization](/github/setting-up-and-managing-organizations-and-teams/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests), and [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests).
226226

227-
## Using OpenSSF Scorecards to secure workflows
227+
{% ifversion code-scanning-actions-language %}
228+
229+
## Using {% data variables.product.prodname_code_scanning %} to secure workflows
230+
231+
{% data reusables.code-scanning.beta-actions-analysis %}
232+
233+
{% data variables.product.prodname_code_scanning_caps %} can automatically detect and suggest improvements for common vulnerable patterns used in {% data variables.product.prodname_actions %} workflows.
234+
For more information on how to enable {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning).
235+
236+
{% endif %}
237+
238+
## Using OpenSSF Scorecards to secure workflow dependencies
228239

229240
[Scorecards](https://github.com/ossf/scorecard) is an automated security tool that flags risky supply chain practices. You can use the [Scorecards action](https://github.com/marketplace/actions/ossf-scorecard-action) and [workflow template](https://github.com/actions/starter-workflows) to follow best security practices. Once configured, the Scorecards action runs automatically on repository changes, and alerts developers about risky supply chain practices using the built-in {% data variables.product.prodname_code_scanning %} experience. The Scorecards project runs a number of checks, including script injection attacks, token permissions, and pinned actions.
230241

‎content/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ For information about {% data variables.product.prodname_code_scanning %} alerts
4949

5050
{% data reusables.code-scanning.codeql-languages-bullets %}
5151

52+
{% data reusables.code-scanning.beta-actions-analysis %}
53+
5254
{% ifversion fpt or ghec or ghes > 3.10 %}
5355

5456
## Modeling custom or niche frameworks

‎data/features/code-scanning-actions-language.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Reference: #16135
2+
# Code scanning is able to analyze Actions workflows.
3+
# This feature is not yet available for GitHub Enterprise Server.
4+
versions:
5+
fpt: '*'
6+
ghec: '*'

‎data/reusables/code-scanning/beta-actions-analysis.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{% ifversion code-scanning-actions-language %}
2+
3+
> [!NOTE]
4+
> The ability to use {% data variables.product.prodname_code_scanning %} to find vulnerabilities in {% data variables.product.prodname_actions %} workflows is currently in {% data variables.release-phases.public_preview %} and subject to change.
5+
6+
{% endif %}

‎data/reusables/code-scanning/codeql-language-identifiers-table.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,13 @@
88
| Java/Kotlin | `java-kotlin` | `java` or `kotlin` |
99
| JavaScript/TypeScript | `javascript-typescript` | `javascript` or `typescript` |
1010
| Python | `python` |
11-
| Ruby | `ruby`
12-
| Swift | `swift`
11+
| Ruby | `ruby` |
12+
| Swift | `swift` |
13+
| {% ifversion code-scanning-actions-language %} |
14+
{% data variables.product.prodname_actions %} workflows | `actions`
15+
| {% endif %}
16+
17+
{% data reusables.code-scanning.beta-actions-analysis %}
1318

1419
> [!NOTE]
1520
> If you specify one of the alternative identifiers, this is equivalent to using the standard language identifier. For example, specifying `javascript` instead of `javascript-typescript` will not exclude analysis of TypeScript code. You can do this in an advanced setup workflow with the `--paths-ignore` option. For more information, see "[AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan)."

‎data/reusables/code-scanning/codeql-languages-bullets.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,10 @@
77
* Python
88
* Ruby
99
* Swift
10+
{% ifversion code-scanning-actions-language %}* {% data variables.product.prodname_actions %} workflows{% endif %}
1011

1112
> [!NOTE]
13+
>
1214
> * Use {% ifversion codeql-language-identifiers-311 %}`java-kotlin`{% else %}`java`{% endif %} to analyze code written in Java, Kotlin or both.
1315
> * Use {% ifversion codeql-language-identifiers-311 %}`javascript-typescript`{% else %}`javascript`{% endif %} to analyze code written in JavaScript, TypeScript or both.
1416

0 commit comments

Comments
 (0)