False positive for the rule `actions/pr-on-self-hosted-runner`

Bắt đầu bằng cách tái hiện cảnh báo actions/pr-on-self-hosted-runner với workflow runs-on dựa trên biểu thức được hiển thị trong issue. Xác định phần triển khai của rule và các test của nó, sau đó cập nhật hành vi để biểu thức chọn windows-latest hoặc ubuntu-latest này không bị báo cáo là self-hosted; thêm hoặc điều chỉnh một regression test và xác minh rằng cảnh báo đã biến mất.

Description of the false positive

False positive for the rule actions/pr-on-self-hosted-runner when runs-on is an expression.

We have an expression for whether the job runs on windows-latest or ubuntu-latest. Neither are self hosted.

    runs-on: ${{ ((matrix.language == 'c-cpp' || matrix.language == 'csharp') && 'windows-latest') || 'ubuntu-latest' }}

Code samples or links to source code

name: "CodeQL Advanced"

on:
  push:
    branches: [ "master" ]
  pull_request:
    branches: [ "master" ]
  schedule:
    - cron: '42 8 * * 4'
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners (GitHub.com only)
    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
    runs-on: ${{ ((matrix.language == 'c-cpp' || matrix.language == 'csharp') && 'windows-latest') || 'ubuntu-latest' }}
    env:
      CONAN_PASSWORD: ${{ secrets.RHAPSODY_ARTIFACTORY_KEY }}
      CONAN_LOGIN_USERNAME: ${{ vars.RHAPSODY_ARTIFACTORY_USER }}

    permissions:
      # required for all workflows
      security-events: write

      # required to fetch internal or private CodeQL packs
      packages: read

      # only required for workflows in private repositories
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
        - language: actions
          build-mode: none
          queries: actions-all
        - language: c-cpp
          build-mode: manual
        - language: csharp
          build-mode: manual
        - language: java-kotlin
          build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
        - language: javascript-typescript
          build-mode: none
        - language: python
          build-mode: none
        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
        # Use `c-cpp` to analyze code written in C, C++ or both
        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Add any setup steps before running the `github/codeql-action/init` action.
    # This includes steps like installing compilers or runtimes (`actions/setup-node`
    # or others). This is typically only required for manual builds.
    # - name: Setup runtime (example)
    #   uses: actions/setup-example@v1

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        queries: ${{ matrix.queries }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"

URL to the alert on GitHub code scanning (optional)