Removing first-party entries from trustedActionsOwnerDataModel

Closed

#22,409 opened on Aug 22, 2026 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 5/5
Estimated time: Over a week
Newbie friendliness: 45/100

Issue type: Feature
Clarity: Mostly clear
Activity status: Active
Domain: security

Research direction

Start by reviewing the trustedActionsOwnerDataModel extension examples in the issue and how first-party owners are currently represented. Compare the proposed negation, removesFrom, and override approaches, then define which behavior and syntax should be supported. Done means a documented, tested way to remove selected first-party organizations so unpinned warnings can be enabled.

Written by the indexing model from the issue text.

Description

question

I would like to see the ability to remove the first-party orgs from the trustedActionsOwnerDataModel, enabling unpinned warnings on first-party actions. If we're mandating SHA pinning on all external actions but GitHub's actions get overlooked, it leaves a gap in our code scanning.

Current usage:

extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: trustedActionsOwnerDataModel
    data:
      - ["org1"]
      - ["org2"]

Potential (psuedocode, not real working examples):

extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: trustedActionsOwnerDataModel
    data:
      - ["org1"]
      - ["org2"]
      - ["!github"] # this syntax
      - ["!actions"]
      - ["!advanced-security"]

  - removesFrom: # or this syntax?
      pack: codeql/actions-all
      extensible: trustedActionsOwnerDataModel
    data:
      - ["github"]
      - ["actions"]
      - ["advanced-security"]

  - addsTo:  # or this?
      pack: codeql/actions-all
      extensible: distrustedActionsOwnerOverrideDataModel # new
    data:
      - ["github"]
      - ["actions"]
      - ["advanced-security"]

Dominant language: CodeQL
Stars: 10.1k
Forks: 2.1k
Avg merge: 2d 16h
Merged PRs (30d): 143

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Reflected XSS in loopback OAuth callback via error_description Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

punkpeye/mcp-remote#369 · Opened Sep 23, 2026
qs-6.15.2.tgz: 2 vulnerabilities (highest severity is: 5.3) Open

Mend: dependency security vulnerability untriaged

Difficulty 1/5 Under an hour Newbie friendliness 86/100

opensearch-project/opensearch-api-specification#1250 · Opened Sep 22, 2026
Setup page for elementary OS omits warning about unpatched pre-installed Flatpak (1.14.6) Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

flathub/flathub#10349 · Opened Sep 22, 2026
CVE-2024-24786 CPE mismatch Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 90/100

cisagov/vulnrichment#337 · Opened Sep 22, 2026
[BUG - Public]Need user friendly error when trying to create a new account with subaddressing an existing email. Open

bug DUP Reservations

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

bcgov/reserve-rec-public#896 · Opened Sep 22, 2026

More Security issues