CodeQL 2.26.3 Starts Treating GitHub Actions Workflows Like Production Code
GitHub's latest CodeQL release turns its security scanner on the CI/CD pipeline itself, sharpening Actions queries for cache poisoning, output clobbering and untrusted checkouts. The fixes go after false positives hard, with alerts now pointing straight at the workflow expression at fault. JavaScript and TypeScript modeling also gains deeper Vue, promises and Fastify coverage. Sharper alerts matter far more than the 497-query default suite, since triage burns out first.