From 03237320d9feafbbe815e29ac1ac341c764f4c87 Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Thu, 27 Aug 2026 12:54:40 -0400 Subject: [PATCH 1/4] Improve documentation on actions/security/ControlChecks.qll EnvironmentCheck --- .../ql/lib/codeql/actions/security/ControlChecks.qll | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/actions/ql/lib/codeql/actions/security/ControlChecks.qll b/actions/ql/lib/codeql/actions/security/ControlChecks.qll index aea57fdc4b71..f9a472f4abff 100644 --- a/actions/ql/lib/codeql/actions/security/ControlChecks.qll +++ b/actions/ql/lib/codeql/actions/security/ControlChecks.qll @@ -276,9 +276,19 @@ abstract class LabelCheck extends ControlCheck { } } +/** + * This type represents deployment environments that may serve as sanitizers for + * various vunlerabilities. + * + * It is possible to customize which deployment environments apply. The default behavior + * of this model is for any environment to be considered a sanitizer. + * If values are (currently manually/externally) provided in `actions/ql/lib/ext/config/deployment_environment.yml` + * then those names will be used to define the valid sanitizer set. + * To create a default of "no default saniziter environment" one can add an + * empty string to the data array in `deployment_environment.yml`. + */ class EnvironmentCheck extends ControlCheck instanceof Environment { EnvironmentCheck() { - // if there are any custom tuples use those if enabledDeploymentEnvironmentDataModel(_) then enabledDeploymentEnvironmentDataModel(this.(Environment).getName()) else this instanceof Environment From 03edcb9bb1436b0e10a4d04dc4d4ba8ab32eecf0 Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Thu, 27 Aug 2026 15:15:58 -0400 Subject: [PATCH 2/4] Fix spelling mistake --- actions/ql/lib/codeql/actions/security/ControlChecks.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/actions/ql/lib/codeql/actions/security/ControlChecks.qll b/actions/ql/lib/codeql/actions/security/ControlChecks.qll index f9a472f4abff..20dea013a503 100644 --- a/actions/ql/lib/codeql/actions/security/ControlChecks.qll +++ b/actions/ql/lib/codeql/actions/security/ControlChecks.qll @@ -278,7 +278,7 @@ abstract class LabelCheck extends ControlCheck { /** * This type represents deployment environments that may serve as sanitizers for - * various vunlerabilities. + * various vulnerabilities. * * It is possible to customize which deployment environments apply. The default behavior * of this model is for any environment to be considered a sanitizer. From 029d5fb9321b7a37b5509664da0b7787f5bf5d94 Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Fri, 28 Aug 2026 09:47:09 -0400 Subject: [PATCH 3/4] Fix spelling mistake --- actions/ql/lib/codeql/actions/security/ControlChecks.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/actions/ql/lib/codeql/actions/security/ControlChecks.qll b/actions/ql/lib/codeql/actions/security/ControlChecks.qll index 20dea013a503..7a5e5f455683 100644 --- a/actions/ql/lib/codeql/actions/security/ControlChecks.qll +++ b/actions/ql/lib/codeql/actions/security/ControlChecks.qll @@ -284,7 +284,7 @@ abstract class LabelCheck extends ControlCheck { * of this model is for any environment to be considered a sanitizer. * If values are (currently manually/externally) provided in `actions/ql/lib/ext/config/deployment_environment.yml` * then those names will be used to define the valid sanitizer set. - * To create a default of "no default saniziter environment" one can add an + * To create a default of "no default sanitizer environment" one can add an * empty string to the data array in `deployment_environment.yml`. */ class EnvironmentCheck extends ControlCheck instanceof Environment { From 6c7aecae02f1127542fd6b3706a03612a85a25ef Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Mon, 31 Aug 2026 11:36:29 -0400 Subject: [PATCH 4/4] Improve wording on doc in actions/security/ControlChecks.qll --- actions/ql/lib/codeql/actions/security/ControlChecks.qll | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/actions/ql/lib/codeql/actions/security/ControlChecks.qll b/actions/ql/lib/codeql/actions/security/ControlChecks.qll index 7a5e5f455683..5bc77f154ee4 100644 --- a/actions/ql/lib/codeql/actions/security/ControlChecks.qll +++ b/actions/ql/lib/codeql/actions/security/ControlChecks.qll @@ -282,10 +282,10 @@ abstract class LabelCheck extends ControlCheck { * * It is possible to customize which deployment environments apply. The default behavior * of this model is for any environment to be considered a sanitizer. - * If values are (currently manually/externally) provided in `actions/ql/lib/ext/config/deployment_environment.yml` - * then those names will be used to define the valid sanitizer set. - * To create a default of "no default sanitizer environment" one can add an - * empty string to the data array in `deployment_environment.yml`. + * If values are provided then those names + * will be used to define the valid sanitizer set. + * To describe the situation where there is no acceptable sanitizer environment + * populate the predicate `enabledDeploymentEnvironmentDataModel` to contain a single empty string. */ class EnvironmentCheck extends ControlCheck instanceof Environment { EnvironmentCheck() {