Skip to content

fix: treat github/* as a verified first-party publisher #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fbcouch merged 2 commits into from
Jun 19, 2026
Merged

fix: treat github/* as a verified first-party publisher #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
936c66f
[verify-github-namespace] fix: treat github/* as a verified first-par…
fbcouch Jun 19, 2026
5b18a7e
[verify-github-namespace] chore: drop github-namespace CI test; cut 1…
fbcouch Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.4.3] - 2026-06-18

### Fixed
- **`github` namespace always verified**: GitHub's own `github/*` org (e.g. `github/codeql-action`) is now unconditionally trusted, matching the existing treatment of `actions/*` and the verified-publisher list already documented in the README. GitHub does not apply the third-party "partner organization" badge to its own first-party org, so the Marketplace scrape could not confirm it, producing spurious "Not from verified publisher" failures for first-party actions like CodeQL.

## [1.4.2] - 2026-03-11

### Fixed
Expand Down
7 changes: 5 additions & 2 deletions audit_actions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,8 +148,11 @@ def is_commit_hash(self, version: str) -> bool:

def check_verified_publisher(self, owner: str, action_name: str = None) -> bool:
"""Check if the action owner is a verified publisher by fetching repo page and finding marketplace link."""
# GitHub's own 'actions' namespace is always verified
if owner == 'actions':
# GitHub's own first-party namespaces are always verified. GitHub
# does not badge its own org as a third-party "partner organization"
# on the Marketplace, so the scrape-based check below cannot confirm
# them. Both are already documented as verified publishers in README.
if owner in ('actions', 'github'):
return True

# Return cached result (covers both verified and non-verified outcomes)
Expand Down
Loading