Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
10k
Code
Issues
999
Pull requests
469
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Commits
Breadcrumbs
History for
codeql
actions
on
codeql-cli/latest
User selector
All users
Datepicker
All time
Commit history
Commits on Aug 20, 2026
Release preparation for version 2.26.4
github-actions[bot]
committed
2bbab1b
View commit details
Copy full SHA for 2bbab1b
View code at this point
Browse repository at this point
Commits on Aug 19, 2026
Merge pull request #22368 from computersarebad/actor-if-check-event-validity
Show description for 039c2b5
jketema
authored
039c2b5
View commit details
Copy full SHA for 039c2b5
View code at this point
Browse repository at this point
Split change note into breaking and minorAnalysis notes
Show description for 0a376e8
computersarebad
and
Copilot
committed
0a376e8
View commit details
Copy full SHA for 0a376e8
View code at this point
Browse repository at this point
Actions: Fix typo in change note
jketema
committed
9919db5
View commit details
Copy full SHA for 9919db5
View code at this point
Browse repository at this point
Commits on Aug 18, 2026
Add test coverage for sender, head_commit and commits checks
Show description for dc6ee11
computersarebad
and
Copilot
committed
dc6ee11
View commit details
Copy full SHA for dc6ee11
View code at this point
Browse repository at this point
Simplify EventActorIfCheck by binding context_prefix as a field
Show description for e9d9d3a
computersarebad
and
Copilot
committed
e9d9d3a
View commit details
Copy full SHA for e9d9d3a
View code at this point
Browse repository at this point
Split payload-field actor checks into EventActorIfCheck
Show description for 3048f47
computersarebad
and
Copilot
committed
3048f47
View commit details
Copy full SHA for 3048f47
View code at this point
Browse repository at this point
Commits on Aug 17, 2026
Actions: ActorIfCheck should not protect events that do not populate the checked field
Show description for 9251d21
computersarebad
and
Copilot
committed
9251d21
View commit details
Copy full SHA for 9251d21
View code at this point
Browse repository at this point
Commits on Aug 12, 2026
Merge branch 'main' into fix-actions-unpinned-reusable-workflows
theinfosecguy
authored
ed82161
View commit details
Copy full SHA for ed82161
View code at this point
Browse repository at this point
Simplify composite action lookup
theinfosecguy
committed
710a753
View commit details
Copy full SHA for 710a753
View code at this point
Browse repository at this point
Commits on Aug 11, 2026
Merge branch 'main' into knewbury01/customize-actions-sanitizers
mbaluda
authored
72ad4e5
View commit details
Copy full SHA for 72ad4e5
View code at this point
Browse repository at this point
Commits on Aug 6, 2026
Post-release preparation for codeql-cli-2.26.3
github-actions[bot]
committed
47d6b11
View commit details
Copy full SHA for 47d6b11
View code at this point
Browse repository at this point
Release preparation for version 2.26.3
github-actions[bot]
committed
fae4a92
View commit details
Copy full SHA for fae4a92
View code at this point
Browse repository at this point
Commits on Aug 5, 2026
Detect unpinned reusable workflows
theinfosecguy
committed
d85deef
View commit details
Copy full SHA for d85deef
View code at this point
Browse repository at this point
Merge pull request #22260 from JarLob/fix/actions-cache-poisoning-cache-write-access
Show description for 5d5b0c7
aschackmull
authored
5d5b0c7
View commit details
Copy full SHA for 5d5b0c7
View code at this point
Browse repository at this point
Commits on Aug 4, 2026
Remove SelfHostedQuery completely
JarLob
committed
22c5ab2
View commit details
Copy full SHA for 22c5ab2
View code at this point
Browse repository at this point
Merge branch 'main' of https://github.com/github/codeql into fix/actions-cache-poisoning-cache-write-access
JarLob
committed
6a2d7be
View commit details
Copy full SHA for 6a2d7be
View code at this point
Browse repository at this point
Merge pull request #22274 from JarLob/remove/actions-self-hosted-runner-query
Show description for 2f2b4c8
aschackmull
authored
2f2b4c8
View commit details
Copy full SHA for 2f2b4c8
View code at this point
Browse repository at this point
Commits on Aug 3, 2026
Actions: Remove experimental self-hosted runner query
Show description for 7a7dae0
JarLob
committed
7a7dae0
View commit details
Copy full SHA for 7a7dae0
View code at this point
Browse repository at this point
Commits on Jul 31, 2026
Add change note
JarLob
committed
caf91c9
View commit details
Copy full SHA for caf91c9
View code at this point
Browse repository at this point
Reworded the misleading 'Unprivileged'
JarLob
committed
c40fe85
View commit details
Copy full SHA for c40fe85
View code at this point
Browse repository at this point
Merge github/main into fix/actions-cache-poisoning-cache-write-access
Show description for 827af90
JarLob
committed
827af90
View commit details
Copy full SHA for 827af90
View code at this point
Browse repository at this point
Remove unreachable workflow_call cache access handling
Show description for cd7f6b7
JarLob
committed
cd7f6b7
View commit details
Copy full SHA for cd7f6b7
View code at this point
Browse repository at this point
Add tests
JarLob
committed
1900b61
View commit details
Copy full SHA for 1900b61
View code at this point
Browse repository at this point
Constrain Actions source helper evaluation
JarLob
committed
8a89360
View commit details
Copy full SHA for 8a89360
View code at this point
Browse repository at this point
Merge remote-tracking branch 'github/main' into fix/actions-output-clobbering-regex
Show description for c9727af
JarLob
committed
c9727af
View commit details
Copy full SHA for c9727af
View code at this point
Browse repository at this point
Merge pull request #22243 from JarLob/improve/actions-untrusted-checkout-source-link
Show description for ddb7e3f
aschackmull
authored
ddb7e3f
View commit details
Copy full SHA for ddb7e3f
View code at this point
Browse repository at this point
Merge pull request #22235 from JarLob/fix/actions-envvar-injection-precision
Show description for 0fb9774
aschackmull
authored
0fb9774
View commit details
Copy full SHA for 0fb9774
View code at this point
Browse repository at this point
Merge branch 'main' into improve/actions-untrusted-checkout-source-link
JarLob
authored
a44c25c
View commit details
Copy full SHA for a44c25c
View code at this point
Browse repository at this point
Apply batched suggestions from code review
Show description for 9d147bc
JarLob
and
aschackmull
authored
9d147bc
View commit details
Copy full SHA for 9d147bc
View code at this point
Browse repository at this point
Delay envvar event-name correlation
JarLob
committed
de68881
View commit details
Copy full SHA for de68881
View code at this point
Browse repository at this point
Fix FP in envvar injection
JarLob
committed
26da3e7
View commit details
Copy full SHA for 26da3e7
View code at this point
Browse repository at this point
Merge remote-tracking branch 'github/main' into improve-clobbering-query-message
Show description for 7f5c922
JarLob
committed
7f5c922
View commit details
Copy full SHA for 7f5c922
View code at this point
Browse repository at this point
The regex wasn't escaping external input
JarLob
committed
b9a5dd4
View commit details
Copy full SHA for b9a5dd4
View code at this point
Browse repository at this point
Merge pull request #22236 from JarLob/fix/actions-merge-group-event-mapping
Show description for 5def214
aschackmull
authored
5def214
View commit details
Copy full SHA for 5def214
View code at this point
Browse repository at this point
Previous
Next
You can’t perform that action at this time.
github-actions[bot]
