Are the Actions model files in ext/manual and ext/generated actively used and maintained?

[XinyuZhangXvX]

The model files under actions/ql/lib/ext/manual/ and actions/ql/lib/ext/generated/ define threat models for various GitHub Actions. Are these models used by any non-experimental queries? Why haven't these models been updated in ~2 years?

[redsun82]

👋 @XinyuZhangXvX the short answer to the first part of your question is that yes, the models are in part used in non-experimental queries. In particular envvar-injection and code-injection sink kinds are used. Other sink kinds (e.g. command-injection, output-clobbering) are instead only used in experimental queries at this time.

As for why these models haven't been updated, we have that tracked but we did not get to do it. I'll see if reaching out to our internal teams will make this happen.