Removing first-party entries from trustedActionsOwnerDataModel

[bradam12]

I would like to see the ability to remove the first-party orgs from the trustedActionsOwnerDataModel, enabling unpinned warnings on first-party actions. If we're mandating SHA pinning on all external actions but GitHub's actions get overlooked, it leaves a gap in our code scanning.

Current usage:

extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: trustedActionsOwnerDataModel
    data:
      - ["org1"]
      - ["org2"]

Potential (psuedocode, not real working examples):

extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: trustedActionsOwnerDataModel
    data:
      - ["org1"]
      - ["org2"]
      - ["!github"] # this syntax
      - ["!actions"]
      - ["!advanced-security"]

  - removesFrom: # or this syntax?
      pack: codeql/actions-all
      extensible: trustedActionsOwnerDataModel
    data:
      - ["github"]
      - ["actions"]
      - ["advanced-security"]

  - addsTo:  # or this?
      pack: codeql/actions-all
      extensible: distrustedActionsOwnerOverrideDataModel # new
    data:
      - ["github"]
      - ["actions"]
      - ["advanced-security"]

[redsun82]

👋 @bradam12 I'm actively taking a look at this, as it seems like a legitimate request to me. However, keep in mind that we have 2 separate ways of allowing unpinned actions:

• the trusted owners you mention
• a list of actions that have immutable releases (e.g. actions/checkout)

So while I opened #22415 to address this specific ask, you might still not get the results you expect because of the immutable actions allow list.

I've opened this issue to track the second point, as I have the feeling we shouldn't blanket-allow immutable actions that have any version, if it's not a full semver that actually pins it. I will discuss it internally.

[bradam12]

@redsun82 Thank you! Thanks for the info on immutable releases, I did not know about that allowance.

Agreed with your second point. Good catch.