Merge branch 'main' of https://github.com/github/codeql into fix/actions-cache-poisoning-cache-write-access

Author: JarLob

MODULE.bazel

@@ -326,10 +326,11 @@ ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archi
 # go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
 ripunzip_archive(
     name = "ripunzip",
-    sha256_linux = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
-    sha256_macos_arm = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
-    sha256_macos_intel = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
-    sha256_windows = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
+    sha256_linux_arm64 = "a282740ef376ff8dc0de3c589b7457598db15cc045b7daa688f15531612e0bbe",
+    sha256_linux_x64 = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
+    sha256_macos_arm64 = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
+    sha256_macos_x64 = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
+    sha256_windows_x64 = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
     version = "2.0.4",
 )
 

actions/ql/integration-tests/query-suite/not_included_in_qls.expected

@@ -11,7 +11,6 @@ ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql
 ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql
 ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
 ql/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
-ql/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
 ql/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
 ql/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql
 ql/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql

actions/ql/lib/change-notes/2026-08-03-deprecate-self-hosted-query.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The `codeql.actions.security.SelfHostedQuery` module has been deprecated because runner labels do not reliably distinguish self-hosted runners from managed runners.

actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll

@@ -1,3 +1,8 @@
+/**
+ * DEPRECATED: Runner labels do not reliably distinguish self-hosted runners from managed runners.
+ */
+deprecated module;
+
 import actions
 
 bindingset[runner]

actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql

@@ -1,5 +1,5 @@
 /**
- * @name Cache Poisoning via low-privileged code injection
+ * @name Cache Poisoning via code injection
  * @description The cache can be poisoned by untrusted code, leading to a cache poisoning attack.
  * @kind path-problem
  * @problem.severity error
@@ -28,5 +28,5 @@ where
     check.protects(source.getNode().asExpr(), event, "code-injection")
   )
 select sink.getNode(), source, sink,
-  "Unprivileged code injection in $@, which may lead to cache poisoning ($@).", sink,
+  "Code injection in $@ may allow poisoning the default-branch cache (event trigger: $@).", sink,
   sink.getNode().asExpr().(Expression).getRawExpression(), event, event.getName()

actions/ql/src/change-notes/2026-07-31-cache-poisoning-code-injection-wording.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* The name and alert message of the `actions/cache-poisoning/code-injection` query have been reworded for clarity.