Actions: resolve TODOs from diff-informed patch

github · Jan 22, 2025 · cf50cbb · cf50cbb
1 parent 12bf31e
commit cf50cbb
Showing 1 changed file with 2 additions and 6 deletions.
diff --git a/actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll b/actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll
@@ -72,9 +72,7 @@ private module ActionsMutableRefCheckoutConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() {
-    // TODO(diff-informed): Manually verify if config can be diff-informed.
-    // actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll:238: Flow call outside 'select' clause
-    none()
+    none() // The query selects the enclosing step containing the sink
   }
 }
 
@@ -129,9 +127,7 @@ private module ActionsSHACheckoutConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() {
-    // TODO(diff-informed): Manually verify if config can be diff-informed.
-    // actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll:273: Flow call outside 'select' clause
-    none()
+    none() // The query selects the enclosing step containing the sink
   }
 }