Merge branch 'main' into fix-actions-unpinned-reusable-workflows

Author: theinfosecguy

.github/instructions/ql-files.instructions.md

@@ -1,3 +1,13 @@
+## 0.5.0
+
+### Breaking Changes
+
+* The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted runners from managed runners.
+
+### Minor Analysis Improvements
+
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.
+
 ## 0.4.40
 
 ### Minor Analysis Improvements

Cargo.lock

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an enironment is no longer a sufficient sanitizer.

actions/ql/lib/CHANGELOG.md

@@ -0,0 +1,9 @@
+## 0.5.0
+
+### Breaking Changes
+
+* The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted runners from managed runners.
+
+### Minor Analysis Improvements
+
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.

actions/ql/lib/change-notes/2026-07-22-environment-check-sanitizer-mad.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.40
+lastReleaseVersion: 0.5.0

actions/ql/lib/change-notes/2026-07-27-merge-group-event-source.md

@@ -164,3 +164,12 @@ predicate untrustedGhCommandDataModel(string cmd_regex, string flag) {
 predicate actionsPermissionsDataModel(string action, string permission) {
   Extensions::actionsPermissionsDataModel(action, permission)
 }
+
+/**
+ * MaD models for deployment environments
+ * Fields:
+ *    - name: deployment environment name, e.g. `Public CI`
+ */
+predicate enabledDeploymentEnvironmentDataModel(string name) {
+  Extensions::enabledDeploymentEnvironmentDataModel(name)
+}

actions/ql/lib/change-notes/2026-08-04-remove-self-hosted-query-library.md

@@ -88,3 +88,12 @@ extensible predicate untrustedGhCommandDataModel(string cmd_regex, string flag);
  * - see https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token for documentation of token permissions.
  */
 extensible predicate actionsPermissionsDataModel(string action, string permission);
+
+/**
+ * Holds for deployment environments that exist with `name` for a given repository.
+ * * - 'name' is the name of the environment defined.
+ *   E.g. for the deployment environment `environment: EnvironmentInRepo`, `name` is `EnvironmentInRepo`.
+ * Requires this to be externally supplied but once done can be used to
+ * toggle precision of whether that suffices or not as a control check by contributing to `EnvironmentCheck`.
+ */
+extensible predicate enabledDeploymentEnvironmentDataModel(string name);