Actions: Correctly check reusable workflow permissions in actions/missing-workflow-permissions#21636
Actions: Correctly check reusable workflow permissions in actions/missing-workflow-permissions#21636jketema merged 4 commits intogithub:mainfrom
actions/missing-workflow-permissions#21636Conversation
| // The workflow is reusable and cannot be triggered in any other way; check callers | ||
| exists(ReusableWorkflow r | r = job.getEnclosingWorkflow() | | ||
| not exists(Event e | e = r.getOn().getAnEvent() | e.getName() != "workflow_call") and | ||
| forall(Job caller | caller = job.getEnclosingWorkflow().(ReusableWorkflow).getACaller() | |
There was a problem hiding this comment.
Thinking loud here: If there are no callers, this is vacuously true.
So in this case it is true when: the workflow is reusable, it is only triggered via workflow_call and nobody calls it.
Should we use a forex instead?
There was a problem hiding this comment.
Why? In that case we have an unused reusable workflow, which is perfectly fine.
There was a problem hiding this comment.
That’s exactly what I wanted to confirm: that it’s acceptable to have a reusable workflow that isn’t used without permission. Thanks
There was a problem hiding this comment.
This maintains the current behavior of the query, and I don't think we want to change that.
Once the workflow starts getting used and the caller does not set any permissions, this will be flagged up.
2 participants
Fixes: #21629