import-action-entrypoint.ql

/**
 * @name Import action entrypoint
 * @description Importing the entrypoint file for an action is dangerous
 * because the code from that action will be run when the file is imported.
 * @kind problem
 * @problem.severity error
 * @id javascript/codeql-action/import-action-entrypoint
 */

import javascript

class ActionEntrypointFile extends File {
  ActionEntrypointFile() {
    exists(Module m | m.getPath() = this.getAbsolutePath() and
       // This is quite a broad check and relies on the function name, but hopefully it'll be accurate enough
       m.getAStmt().getAChildExpr+().(CallExpr).getCalleeName() = "run") and
    // Requiring the relative path to exist limits us to files in the code repository and avoid libraries
    exists(this.getRelativePath())
  }
}

from ImportDeclaration i
where exists(ActionEntrypointFile f | i.getImportedModule().getPath() = f.getAbsolutePath())
select i, "This imports the entrypoint file for an action. This will execute the code from the action."