Actions tests: add lockfile inline expectations

Author: nodeselector

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/rust-ci.yml

@@ -7,10 +7,10 @@ jobs:
     steps:
     - uses: dtolnay/rust-toolchain@v1
     - uses: DToLnAy/RuSt-ToOlChAiN/save@v1
-    - uses: dtolnay/rust-toolchain@V1
-    - uses: other-workflow/action@v1
-    - uses: mismatched/action@v1
-    - uses: malformed/action@v1
-    - uses: missing/action@v1
+    - uses: dtolnay/rust-toolchain@V1 # $ Alert
+    - uses: other-workflow/action@v1 # $ Alert
+    - uses: mismatched/action@v1 # $ Alert
+    - uses: malformed/action@v1 # $ Alert
+    - uses: missing/action@v1 # $ Alert
   reusable:
-    uses: dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1
+    uses: dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 # $ Alert

actions/ql/test/query-tests/Security/CWE-829-Lockfile/InlineExpectationsTestQuery.ql

@@ -0,0 +1,30 @@
+/**
+ * @kind test-postprocess
+ */
+
+private import codeql.Locations as Locations
+private import codeql.actions.ast.internal.Yaml as Yaml
+private import codeql.util.test.InlineExpectationsTest as T
+import T::TestPostProcessing
+
+private module Impl implements T::InlineExpectationsTestSig {
+  class Location = Locations::Location;
+
+  class ExpectationComment extends Yaml::YamlComment {
+    string getContents() { result = this.getText() }
+  }
+}
+
+private module Input implements T::TestPostProcessing::InputSig<Impl> {
+  string getRelativeUrl(Locations::Location location) {
+    exists(int startLine, int startColumn, int endLine, int endColumn |
+      location.hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
+    |
+      result =
+        location.getFile().getRelativePath() + ":" + startLine + ":" + startColumn + ":" + endLine +
+          ":" + endColumn
+    )
+  }
+}
+
+import T::TestPostProcessing::Make<Impl, Input>

actions/ql/test/query-tests/Security/CWE-829-Lockfile/UnpinnedActionsTag.expected

@@ -3,4 +3,4 @@
 | .github/workflows/rust-ci.yml:12:13:12:32 | mismatched/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'mismatched/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:12:7:13:4 | Uses Step | Uses Step |
 | .github/workflows/rust-ci.yml:13:13:13:31 | malformed/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'malformed/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:13:7:14:4 | Uses Step | Uses Step |
 | .github/workflows/rust-ci.yml:14:13:14:29 | missing/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:14:7:15:2 | Uses Step | Uses Step |
-| .github/workflows/rust-ci.yml:16:11:16:66 | dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 | Job $@ in 'rust-ci.yml' uses reusable workflow 'dtolnay/rust-toolchain/.github/workflows/reusable.yml' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:16:5:16:67 | Job: reusable | Job: reusable |
+| .github/workflows/rust-ci.yml:16:11:16:66 | dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 | Job $@ in 'rust-ci.yml' uses reusable workflow 'dtolnay/rust-toolchain/.github/workflows/reusable.yml' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:16:5:16:77 | Job: reusable | Job: reusable |

actions/ql/test/query-tests/Security/CWE-829-Lockfile/UnpinnedActionsTag.qlref

@@ -1 +1,2 @@
-Security/CWE-829/UnpinnedActionsTag.ql
+query: Security/CWE-829/UnpinnedActionsTag.ql
+postprocess: InlineExpectationsTestQuery.ql