Actions: Add new models for external actions/workflows

actions/extractor/tools/autobuild-impl.ps1

@@ -1,13 +1,11 @@
-# Note: We're adding the `reusable_workflows` subdirectories to proactively
-# record workflows that were called cross-repo, check them out locally,
-# and enable an interprocedural analysis across the workflow files.
-# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
+# Include downloaded external reusable workflows to enable interprocedural analysis.
+# These workflows are stored below a generated UUID directory at the repository root.
 $DefaultPathFilters = @(
     'exclude:**/*',
     'include:.github/workflows/*.yml',
     'include:.github/workflows/*.yaml',
-    'include:.github/reusable_workflows/**/*.yml',
-    'include:.github/reusable_workflows/**/*.yaml',
+    'include:9466014afba34ef28239871ceabf4132/**/*.yml',
+    'include:9466014afba34ef28239871ceabf4132/**/*.yaml',
     'include:**/action.yml',
     'include:**/action.yaml'
 )

actions/extractor/tools/autobuild.sh

@@ -2,16 +2,14 @@
 
 set -eu
 
-# Note: We're adding the `reusable_workflows` subdirectories to proactively
-# record workflows that were called cross-repo, check them out locally,
-# and enable an interprocedural analysis across the workflow files.
-# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
+# Include downloaded external reusable workflows to enable interprocedural analysis.
+# These workflows are stored below a generated UUID directory at the repository root.
 DEFAULT_PATH_FILTERS=$(cat << END
 exclude:**/*
 include:.github/workflows/*.yml
 include:.github/workflows/*.yaml
-include:.github/reusable_workflows/**/*.yml
-include:.github/reusable_workflows/**/*.yaml
+include:9466014afba34ef28239871ceabf4132/**/*.yml
+include:9466014afba34ef28239871ceabf4132/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
 END

actions/extractor/tools/baseline-config.json

@@ -2,8 +2,8 @@
     "paths": [
         ".github/workflows/*.yml",
         ".github/workflows/*.yaml",
-        ".github/reusable_workflows/**/*.yml",
-        ".github/reusable_workflows/**/*.yaml",
+        "9466014afba34ef28239871ceabf4132/**/*.yml",
+        "9466014afba34ef28239871ceabf4132/**/*.yaml",
         "**/action.yml",
         "**/action.yaml"
     ]

actions/ql/lib/codeql/actions/Helper.qll

@@ -48,14 +48,9 @@ string getRepoRoot() {
       w.getLocation()
           .getFile()
           .getRelativePath()
-          .prefix(w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") + 1) and
-    // exclude workflow_enum reusable workflows directory root
-    not result.indexOf(".github/workflows/external/") > -1 and
-    not result.indexOf(".github/actions/external/") > -1
+          .prefix(w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") + 1)
     or
     not w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") > 0 and
-    not w.getLocation().getFile().getRelativePath().indexOf(".github/workflows/external/") > -1 and
-    not w.getLocation().getFile().getRelativePath().indexOf(".github/actions/external/") > -1 and
     result = ""
   )
 }

actions/ql/lib/codeql/actions/ast/internal/Ast.qll

@@ -372,6 +372,14 @@
   }
 }
 
+bindingset[owner, repo, action_path]
+private string externalCompositeActionName(string owner, string repo, string action_path) {
+  action_path.trim() = "" and result = owner.trim() + "/" + repo.trim()
+  or
+  not action_path.trim() = "" and
+  result = owner.trim() + "/" + repo.trim() + "/" + action_path.trim()
+}
+
 class CompositeActionImpl extends AstNodeImpl, TCompositeAction {
   YamlMapping n;
 
@@ -415,7 +423,38 @@
     )
   }
 
+  predicate getAnExternalCompositeActionModel(
+    string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha,
+    string local_path
+  ) {
+    externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha,
+      local_path) and
+    local_path.trim() = this.getLocation().getFile().getRelativePath()
+  }
+
+  predicate isExternalCompositeAction() {
+    exists(
+      string owner, string repo, string action_path, string requested_ref,
+      string resolved_commit_sha, string local_path
+    |
+      this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref,
+        resolved_commit_sha, local_path)
+    )
+    or
+    this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%")
+  }
+
   string getResolvedPath() {
+    exists(
+      string owner, string repo, string action_path, string requested_ref,
+      string resolved_commit_sha, string local_path
+    |
+      this.getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref,
+        resolved_commit_sha, local_path) and
+      result = externalCompositeActionName(owner, repo, action_path) + "@" + requested_ref.trim()
+    )
+    or
+    not this.isExternalCompositeAction() and
     result =
       ["", "./"] +
         this.getLocation()
@@ -424,7 +463,6 @@
             .replaceAll(getRepoRoot(), "")
             .replaceAll("/action.yml", "")
             .replaceAll("/action.yaml", "")
-            .replaceAll(".github/actions/external/", "")
   }
 
   private predicate hasExplicitSecretAccess() {
@@ -542,14 +580,41 @@
     )
   }
 
+  predicate getAnExternalReusableWorkflowModel(
+    string owner, string repo, string workflow_path, string requested_ref,
+    string resolved_commit_sha, string local_path
+  ) {
+    externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref,
+      resolved_commit_sha, local_path) and
+    local_path.trim() = this.getLocation().getFile().getRelativePath()
+  }
+
+  predicate isExternalReusableWorkflow() {
+    exists(
+      string owner, string repo, string workflow_path, string requested_ref,
+      string resolved_commit_sha, string local_path
+    |
+      this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref,
+        resolved_commit_sha, local_path)
+    )
+    or
+    this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%") // root folder for external workflows and composite actions
+  }
+
   string getResolvedPath() {
+    exists(
+      string owner, string repo, string workflow_path, string requested_ref,
+      string resolved_commit_sha, string local_path
+    |
+      this.getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref,
+        resolved_commit_sha, local_path) and
+      result =
+        owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() + "@" + requested_ref.trim()
+    )
+    or
+    not this.isExternalReusableWorkflow() and
     result =
-      ["", "./"] +
-        this.getLocation()
-            .getFile()
-            .getRelativePath()
-            .replaceAll(getRepoRoot(), "")
-            .replaceAll(".github/workflows/external/", "")
+      ["", "./"] + this.getLocation().getFile().getRelativePath().replaceAll(getRepoRoot(), "")
   }
 }
 
@@ -1336,6 +1401,8 @@
 abstract class UsesImpl extends AstNodeImpl {
   abstract string getCallee();
 
+  abstract string getCallableName();
+
   abstract ScalarValueImpl getCalleeNode();
 
   abstract string getVersion();
@@ -1374,6 +1441,77 @@
     else result = u.getValue()
   }
 
+  private predicate isWorkspaceLocalCall() { u.getValue().matches(["./%", ".github/%"]) }
+
+  private predicate isSelfCall() { u.getValue().matches("$/%") }
+
+  private predicate isLocalCall() { this.isWorkspaceLocalCall() or this.isSelfCall() }
+
+  private predicate hasModeledExternalCallee() {
+    exists(
+      string owner, string repo, string action_path, string requested_ref,
+      string resolved_commit_sha, string local_path
+    |
+      externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha,
+        local_path) and
+      this.getCallee() = externalCompositeActionName(owner, repo, action_path) and
+      this.getVersion() = requested_ref.trim()
+    )
+  }
+
+  private predicate hasExternalEnclosingCompositeAction() {
+    exists(CompositeActionImpl action |
+      action = this.getEnclosingCompositeAction() and action.isExternalCompositeAction()
+    )
+  }
+
+  private predicate hasModeledExternalEnclosingCompositeAction() {
+    exists(
+      CompositeActionImpl action, string owner, string repo, string action_path,
+      string requested_ref, string resolved_commit_sha, string local_path
+    |
+      action = this.getEnclosingCompositeAction() and
+      action
+          .getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref,
+            resolved_commit_sha, local_path)
+    )
+  }
+
+  private string getSelfCallableName() {
+    exists(
+      CompositeActionImpl action, string owner, string repo, string action_path,
+      string requested_ref, string resolved_commit_sha, string local_path
+    |
+      action = this.getEnclosingCompositeAction() and
+      action
+          .getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref,
+            resolved_commit_sha, local_path) and
+      result =
+        externalCompositeActionName(owner, repo, this.getCallee().suffix(2)) + "@" +
+          requested_ref.trim()
+    )
+    or
+    not this.hasExternalEnclosingCompositeAction() and
+    result = this.getCallee().suffix(2)
+  }
+
+  override string getCallableName() {
+    this.isWorkspaceLocalCall() and
+    (
+      this.hasModeledExternalEnclosingCompositeAction()
+      or
+      not this.hasExternalEnclosingCompositeAction()
+    ) and
+    result = this.getCallee()
+    or
+    this.isSelfCall() and
+    result = this.getSelfCallableName()
+    or
+    not this.isLocalCall() and
+    this.hasModeledExternalCallee() and
+    result = this.getCallee() + "@" + this.getVersion()
+  }
+
   override ScalarValueImpl getCalleeNode() { result.getNode() = u }
 
   /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
@@ -1388,27 +1526,70 @@
  * Gets a regular expression that parses an `owner/repo@version` reference within a `uses` field in an Actions job step.
  * local repo: octo-org/this-repo/.github/workflows/workflow-1.yml@172239021f7ba04fe7327647b213799853a9eb89
  * local repo: ./.github/workflows/workflow-2.yml
+ * local repo: $/.github/workflows/workflow-2.yml
  * remote repo: octo-org/another-repo/.github/workflows/workflow.yml@v1
  */
 private string repoUsesParser() { result = "([^/]+)/([^/]+)/([^@]+)@(.+)" }
 
-private string pathUsesParser() { result = "\\./(.+)" }
-
 class ExternalJobImpl extends JobImpl, UsesImpl {
   YamlScalar u;
 
   ExternalJobImpl() { n.lookup("uses") = u }
 
   override string getCallee() {
-    if u.getValue().matches("./%")
-    then result = u.getValue().regexpCapture(pathUsesParser(), 1)
+    if u.getValue().matches(["./%", "$/%"])
+    then result = u.getValue().suffix(2)
     else
       result =
         u.getValue().regexpCapture(repoUsesParser(), 1) + "/" +
           u.getValue().regexpCapture(repoUsesParser(), 2) + "/" +
           u.getValue().regexpCapture(repoUsesParser(), 3)
   }
 
+  private predicate isLocalCall() { u.getValue().matches(["./%", "$/%"]) }
+
+  private predicate hasExternalEnclosingWorkflow() {
+    exists(ReusableWorkflowImpl enclosing_workflow |
+      enclosing_workflow = this.getEnclosingWorkflow() and
+      enclosing_workflow.isExternalReusableWorkflow()
+    )
+  }
+
+  private predicate hasModeledExternalCallee() {
+    exists(
+      string owner, string repo, string workflow_path, string requested_ref,
+      string resolved_commit_sha, string local_path
+    |
+      externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref,
+        resolved_commit_sha, local_path) and
+      this.getCallee() = owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() and
+      this.getVersion() = requested_ref.trim()
+    )
+  }
+
+  override string getCallableName() {
+    this.isLocalCall() and
+    exists(
+      ReusableWorkflowImpl enclosing_workflow, string owner, string repo, string workflow_path,
+      string requested_ref, string resolved_commit_sha, string local_path
+    |
+      enclosing_workflow = this.getEnclosingWorkflow() and
+      enclosing_workflow
+          .getAnExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref,
+            resolved_commit_sha, local_path) and
+      result =
+        owner.trim() + "/" + repo.trim() + "/" + this.getCallee() + "@" + requested_ref.trim()
+    )
+    or
+    this.isLocalCall() and
+    not this.hasExternalEnclosingWorkflow() and
+    result = this.getCallee()
+    or
+    not this.isLocalCall() and
+    this.hasModeledExternalCallee() and
+    result = this.getCallee() + "@" + this.getVersion()
+  }
+
   override ScalarValueImpl getCalleeNode() { result.getNode() = u }
 
   /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */

actions/ql/lib/codeql/actions/config/Config.qll

@@ -16,6 +16,42 @@ predicate workflowDataModel(
   Extensions::workflowDataModel(path, trigger, job, secrets_source, permissions, runner)
 }
 
+/**
+ * MaD models for downloaded external reusable workflows
+ * Fields:
+ *    - owner: Repository owner
+ *    - repo: Repository name
+ *    - workflow_path: Workflow path within the repository
+ *    - requested_ref: Ref used by the caller
+ *    - resolved_commit_sha: Commit to which the ref resolved
+ *    - local_path: Downloaded workflow path within the analyzed repository
+ */
+predicate externalReusableWorkflowDataModel(
+  string owner, string repo, string workflow_path, string requested_ref, string resolved_commit_sha,
+  string local_path
+) {
+  Extensions::externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref,
+    resolved_commit_sha, local_path)
+}
+
+/**
+ * MaD models for downloaded external composite actions
+ * Fields:
+ *    - owner: Repository owner
+ *    - repo: Repository name
+ *    - action_path: Action path within the repository
+ *    - requested_ref: Ref used by the caller
+ *    - resolved_commit_sha: Commit to which the ref resolved
+ *    - local_path: Downloaded action metadata path within the analyzed repository
+ */
+predicate externalCompositeActionDataModel(
+  string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha,
+  string local_path
+) {
+  Extensions::externalCompositeActionDataModel(owner, repo, action_path, requested_ref,
+    resolved_commit_sha, local_path)
+}
+
 /**
  * MaD models for repository details
  * Fields: