Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
Accelerator
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Type
/
to search
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2k
Star
9.9k
Code
Issues
996
Pull requests
443
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Commits
Breadcrumbs
History for
codeql
actions
on
codeql-cli-2.26.3
User selector
All users
All time
Commit history
Commits on Aug 6, 2026
Release preparation for version 2.26.3
github-actions[bot]
committed
fae4a92
View commit details
Copy full SHA for fae4a92
View code at this point
Browse repository at this point
Commits on Aug 5, 2026
Merge pull request #22260 from JarLob/fix/actions-cache-poisoning-cache-write-access
Show description for 5d5b0c7
aschackmull
authored
5d5b0c7
View commit details
Copy full SHA for 5d5b0c7
View code at this point
Browse repository at this point
Commits on Aug 4, 2026
Remove SelfHostedQuery completely
JarLob
committed
22c5ab2
View commit details
Copy full SHA for 22c5ab2
View code at this point
Browse repository at this point
Merge branch 'main' of https://github.com/github/codeql into fix/actions-cache-poisoning-cache-write-access
JarLob
committed
6a2d7be
View commit details
Copy full SHA for 6a2d7be
View code at this point
Browse repository at this point
Merge pull request #22274 from JarLob/remove/actions-self-hosted-runner-query
Show description for 2f2b4c8
aschackmull
authored
2f2b4c8
View commit details
Copy full SHA for 2f2b4c8
View code at this point
Browse repository at this point
Commits on Aug 3, 2026
Actions: Remove experimental self-hosted runner query
Show description for 7a7dae0
JarLob
committed
7a7dae0
View commit details
Copy full SHA for 7a7dae0
View code at this point
Browse repository at this point
Commits on Jul 31, 2026
Add change note
JarLob
committed
caf91c9
View commit details
Copy full SHA for caf91c9
View code at this point
Browse repository at this point
Reworded the misleading 'Unprivileged'
JarLob
committed
c40fe85
View commit details
Copy full SHA for c40fe85
View code at this point
Browse repository at this point
Merge github/main into fix/actions-cache-poisoning-cache-write-access
Show description for 827af90
JarLob
committed
827af90
View commit details
Copy full SHA for 827af90
View code at this point
Browse repository at this point
Remove unreachable workflow_call cache access handling
Show description for cd7f6b7
JarLob
committed
cd7f6b7
View commit details
Copy full SHA for cd7f6b7
View code at this point
Browse repository at this point
Add tests
JarLob
committed
1900b61
View commit details
Copy full SHA for 1900b61
View code at this point
Browse repository at this point
Constrain Actions source helper evaluation
JarLob
committed
8a89360
View commit details
Copy full SHA for 8a89360
View code at this point
Browse repository at this point
Merge remote-tracking branch 'github/main' into fix/actions-output-clobbering-regex
Show description for c9727af
JarLob
committed
c9727af
View commit details
Copy full SHA for c9727af
View code at this point
Browse repository at this point
Merge pull request #22243 from JarLob/improve/actions-untrusted-checkout-source-link
Show description for ddb7e3f
aschackmull
authored
ddb7e3f
View commit details
Copy full SHA for ddb7e3f
View code at this point
Browse repository at this point
Merge pull request #22235 from JarLob/fix/actions-envvar-injection-precision
Show description for 0fb9774
aschackmull
authored
0fb9774
View commit details
Copy full SHA for 0fb9774
View code at this point
Browse repository at this point
Merge branch 'main' into improve/actions-untrusted-checkout-source-link
JarLob
authored
a44c25c
View commit details
Copy full SHA for a44c25c
View code at this point
Browse repository at this point
Apply batched suggestions from code review
Show description for 9d147bc
JarLob
and
aschackmull
authored
9d147bc
View commit details
Copy full SHA for 9d147bc
View code at this point
Browse repository at this point
Delay envvar event-name correlation
JarLob
committed
de68881
View commit details
Copy full SHA for de68881
View code at this point
Browse repository at this point
Fix FP in envvar injection
JarLob
committed
26da3e7
View commit details
Copy full SHA for 26da3e7
View code at this point
Browse repository at this point
Merge remote-tracking branch 'github/main' into improve-clobbering-query-message
Show description for 7f5c922
JarLob
committed
7f5c922
View commit details
Copy full SHA for 7f5c922
View code at this point
Browse repository at this point
The regex wasn't escaping external input
JarLob
committed
b9a5dd4
View commit details
Copy full SHA for b9a5dd4
View code at this point
Browse repository at this point
Merge pull request #22236 from JarLob/fix/actions-merge-group-event-mapping
Show description for 5def214
aschackmull
authored
5def214
View commit details
Copy full SHA for 5def214
View code at this point
Browse repository at this point
Merge pull request #22239 from JarLob/fix/actions-schedule-event-name
Show description for 2a9f8c8
aschackmull
authored
2a9f8c8
View commit details
Copy full SHA for 2a9f8c8
View code at this point
Browse repository at this point
Merge pull request #22252 from JarLob/fix/actions-output-clobbering-jq-precision
Show description for 3b46482
aschackmull
authored
3b46482
View commit details
Copy full SHA for 3b46482
View code at this point
Browse repository at this point
Commits on Jul 30, 2026
Address cache poisoning review feedback
JarLob
committed
d2f5244
View commit details
Copy full SHA for d2f5244
View code at this point
Browse repository at this point
Optimize Actions event source matching
Show description for 754e40b
JarLob
committed
754e40b
View commit details
Copy full SHA for 754e40b
View code at this point
Browse repository at this point
Account cache poisoning queries for read-only access on low-trust triggers
JarLob
committed
761de92
View commit details
Copy full SHA for 761de92
View code at this point
Browse repository at this point
Commits on Jul 29, 2026
Restrict jq output-clobbering suppression
JarLob
committed
5b96fcc
View commit details
Copy full SHA for 5b96fcc
View code at this point
Browse repository at this point
Reduce false positives in the clobbering query
JarLob
committed
44724a8
View commit details
Copy full SHA for 44724a8
View code at this point
Browse repository at this point
Improve clobbering query message and documentation
JarLob
committed
e70ba7d
View commit details
Copy full SHA for e70ba7d
View code at this point
Browse repository at this point
Commits on Jul 28, 2026
Write a clickable source link in untrusted checkout message
JarLob
committed
43d485a
View commit details
Copy full SHA for 43d485a
View code at this point
Browse repository at this point
Improve untrusted checkout path provenance
Show description for 78a9f24
JarLob
committed
78a9f24
View commit details
Copy full SHA for 78a9f24
View code at this point
Browse repository at this point
Combine a value-provenance prefix with the existing execution-order suffix for cache poisoning query
JarLob
committed
99675ae
View commit details
Copy full SHA for 99675ae
View code at this point
Browse repository at this point
Add named related locations for cache poisoning query
JarLob
committed
b2641e1
View commit details
Copy full SHA for b2641e1
View code at this point
Browse repository at this point
Commits on Jul 27, 2026
Fixed `Schedule` event mapping
JarLob
committed
0dd3ad6
View commit details
Copy full SHA for 0dd3ad6
View code at this point
Browse repository at this point
Previous
Next
You can’t perform that action at this time.
github-actions[bot]