Merge branch 'main' into feat/csharp-missed-firstordefault-opprtunity

Author: baywet

MODULE.bazel

@@ -278,6 +278,7 @@ use_repo(
     "kotlin-compiler-2.3.0",
     "kotlin-compiler-2.3.20",
     "kotlin-compiler-2.4.0",
+    "kotlin-compiler-2.4.20",
     "kotlin-compiler-embeddable-1.8.0",
     "kotlin-compiler-embeddable-1.9.0-Beta",
     "kotlin-compiler-embeddable-1.9.20-Beta",
@@ -290,6 +291,7 @@ use_repo(
     "kotlin-compiler-embeddable-2.3.0",
     "kotlin-compiler-embeddable-2.3.20",
     "kotlin-compiler-embeddable-2.4.0",
+    "kotlin-compiler-embeddable-2.4.20",
     "kotlin-stdlib-1.8.0",
     "kotlin-stdlib-1.9.0-Beta",
     "kotlin-stdlib-1.9.20-Beta",
@@ -302,10 +304,11 @@ use_repo(
     "kotlin-stdlib-2.3.0",
     "kotlin-stdlib-2.3.20",
     "kotlin-stdlib-2.4.0",
+    "kotlin-stdlib-2.4.20",
 )
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.27.0")
+go_sdk.download(version = "1.27.1")
 
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.6.1
+
+### New Features
+
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.
+
+### Minor Analysis Improvements
+
+* Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+
 ## 0.6.0
 
 ### Breaking Changes

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -1,4 +1,10 @@
----
-category: minorAnalysis
----
+## 0.6.1
+
+### New Features
+
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.
+
+### Minor Analysis Improvements
+
 * Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.

…9-association-if-check-event-validity.md …ns/ql/lib/change-notes/released/0.6.1.mdactions/ql/lib/change-notes/2026-08-19-association-if-check-event-validity.md renamed to actions/ql/lib/change-notes/released/0.6.1.md actions/ql/lib/change-notes/2026-08-19-association-if-check-event-validity.md renamed to actions/ql/lib/change-notes/released/0.6.1.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1

actions/ql/lib/codeql-pack.release.yml

@@ -276,9 +276,19 @@ abstract class LabelCheck extends ControlCheck {
   }
 }
 
+/**
+ * A deployment environment that may serve as a sanitizer for
+ * various vulnerabilities.
+ *
+ * It is possible to customize which deployment environments apply. The default behavior
+ * of this model is for any environment to be considered a sanitizer.
+ * If values are provided then those names
+ * will be used to define the valid sanitizer set.
+ * To describe the situation where there is no acceptable sanitizer environment
+ * populate the predicate `enabledDeploymentEnvironmentDataModel` to contain a single empty string.
+ */
 class EnvironmentCheck extends ControlCheck instanceof Environment {
   EnvironmentCheck() {
-    // if there are any custom tuples use those
     if enabledDeploymentEnvironmentDataModel(_)
     then enabledDeploymentEnvironmentDataModel(this.(Environment).getName())
     else this instanceof Environment

actions/ql/lib/codeql/actions/security/ControlChecks.qll

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.6.1-dev
+version: 0.6.2-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/lib/qlpack.yml

@@ -1,3 +1,7 @@
+## 0.6.35
+
+No user-facing changes.
+
 ## 0.6.34
 
 ### Minor Analysis Improvements

actions/ql/src/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 0.6.35
+
+No user-facing changes.

actions/ql/src/change-notes/released/0.6.35.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.34
+lastReleaseVersion: 0.6.35