CodeQL library for JavaScript/TypeScript
codeql/javascript-all 0.8.13 (changelog, source)
Search

Predicate Actions::getASimpleReferenceExpression

Holds if ${{ e }} is a GitHub Actions expression evaluated within this YAML string. See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions. Only finds simple expressions like ${{ github.event.comment.body }}, where the expression contains only alphanumeric characters, underscores, dots, or dashes. Does not identify more complicated expressions like ${{ fromJSON(env.time) }}, or ${{ format(‘{{Hello {0}!}}’, github.event.head_commit.author.name) }}

Import path

import semmle.javascript.Actions
string getASimpleReferenceExpression(YamlString node)