Merge remote-tracking branch 'origin/main' into andersfugmann/kotlin-2.4.20rc

Author: andersfugmann

MODULE.bazel

@@ -237,11 +237,13 @@ use_repo(
     swift,
     "swift_toolchain",
     "swift_toolchain_ubuntu22.04",
+    "swift_toolchain_ubuntu22.04-aarch64",
     "swift_toolchain_xcode",
 )
 
 register_toolchains(
     "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04",
+    "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04-aarch64",
     "@swift_toolchain//:swift_toolchain_exec_xcode",
     dev_dependency = True,
 )

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.6.0
+
+### Breaking Changes
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) were split out of `ActorIfCheck` into a new class `EventActorIfCheck`. The `ActorIfCheck` class now only covers `github.actor` and `github.triggering_actor`.
+
+### Minor Analysis Improvements
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an environment is no longer a sufficient sanitizer.
+
 ## 0.5.0
 
 ### Breaking Changes

actions/ql/lib/change-notes/2026-07-22-environment-check-sanitizer-mad.md

@@ -0,0 +1,10 @@
+## 0.6.0
+
+### Breaking Changes
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) were split out of `ActorIfCheck` into a new class `EventActorIfCheck`. The `ActorIfCheck` class now only covers `github.actor` and `github.triggering_actor`.
+
+### Minor Analysis Improvements
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an environment is no longer a sufficient sanitizer.

actions/ql/lib/change-notes/2026-08-17-actor-if-check-event-validity.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.6.0

actions/ql/lib/change-notes/2026-08-18-split-event-actor-if-check.md

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.5.1-dev
+version: 0.6.1-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/lib/change-notes/released/0.6.0.md

@@ -1,3 +1,9 @@
+## 0.6.34
+
+### Minor Analysis Improvements
+
+* The `actions/unpinned-tag` query now detects mutable references to reusable workflows.
+
 ## 0.6.33
 
 ### Query Metadata Changes

actions/ql/lib/codeql-pack.release.yml

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 0.6.34
+
+### Minor Analysis Improvements
+
 * The `actions/unpinned-tag` query now detects mutable references to reusable workflows.