Merge remote-tracking branch 'upstream/main' into tausbn/rust-upgrade-to-rust-analyzer-0.0.328

Author: hvitved

.github/instructions/ql-files.instructions.md

@@ -24,8 +24,14 @@
 /rust/ @github/codeql-rust
 /rust/extractor/ @github/codeql-rust @github/code-scanning-language-coverage
 /shared/ @github/codeql-shared-libraries-reviewers
+/shared/cpp/ @github/code-scanning-language-coverage
+/shared/yeast/ @github/code-scanning-language-coverage
+/shared/yeast-macros/ @github/code-scanning-language-coverage
+/shared/yeast-schema/ @github/code-scanning-language-coverage
 /swift/ @github/codeql-swift
 /swift/extractor/ @github/codeql-swift @github/code-scanning-language-coverage
+/unified/extractor/ @github/code-scanning-language-coverage
+/unified/swift-syntax-rs/ @github/code-scanning-language-coverage
 /misc/codegen/ @github/codeql-swift
 /java/kotlin-extractor/ @github/codeql-kotlin @github/code-scanning-language-coverage
 /java/ql/test-kotlin1/ @github/codeql-kotlin

CODEOWNERS

@@ -11,7 +11,6 @@ ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql
 ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql
 ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
 ql/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
-ql/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
 ql/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
 ql/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql
 ql/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql

Cargo.lock

@@ -1,3 +1,13 @@
+## 0.5.0
+
+### Breaking Changes
+
+* The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted runners from managed runners.
+
+### Minor Analysis Improvements
+
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.
+
 ## 0.4.40
 
 ### Minor Analysis Improvements

actions/ql/integration-tests/query-suite/not_included_in_qls.expected

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an enironment is no longer a sufficient sanitizer.

actions/ql/lib/CHANGELOG.md

@@ -0,0 +1,9 @@
+## 0.5.0
+
+### Breaking Changes
+
+* The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted runners from managed runners.
+
+### Minor Analysis Improvements
+
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.

actions/ql/lib/change-notes/2026-07-22-environment-check-sanitizer-mad.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.40
+lastReleaseVersion: 0.5.0

actions/ql/lib/change-notes/2026-07-27-merge-group-event-source.md

@@ -164,3 +164,12 @@ predicate untrustedGhCommandDataModel(string cmd_regex, string flag) {
 predicate actionsPermissionsDataModel(string action, string permission) {
   Extensions::actionsPermissionsDataModel(action, permission)
 }
+
+/**
+ * MaD models for deployment environments
+ * Fields:
+ *    - name: deployment environment name, e.g. `Public CI`
+ */
+predicate enabledDeploymentEnvironmentDataModel(string name) {
+  Extensions::enabledDeploymentEnvironmentDataModel(name)
+}