@@ -208,28 +208,33 @@ class Workflow extends AstNode instanceof WorkflowImpl {
208208
209209 predicate hasSingleTrigger ( string trigger ) {
210210 this .getATriggerEvent ( ) = trigger and
211- count ( string t | this .getATriggerEvent ( ) = t | t ) = 1
211+ count ( this .getATriggerEvent ( ) ) = 1
212212 }
213213
214214 predicate isPrivileged ( ) {
215215 // The Workflow has a permission to write to some scope
216- this .getPermissions ( ) .getAPermission ( ) = "write" and
216+ this .getPermissions ( ) .getAPermission ( ) = "write"
217+ or
217218 // The Workflow accesses a secret
218219 exists ( SecretsExpression expr |
219220 expr .getEnclosingWorkflow ( ) = this and not expr .getFieldName ( ) = "GITHUB_TOKEN"
220221 )
221222 or
222223 // The Workflow is triggered by an event other than `pull_request`
223- not this .hasSingleTrigger ( "pull_request" )
224+ count ( this .getATriggerEvent ( ) ) = 1 and
225+ not this .getATriggerEvent ( ) = [ "pull_request" , "workflow_call" ]
224226 or
225227 // The Workflow is only triggered by `workflow_call` and there is
226228 // a caller workflow triggered by an event other than `pull_request`
227229 this .hasSingleTrigger ( "workflow_call" ) and
228230 exists ( ExternalJob call , Workflow caller |
229231 call .getCallee ( ) = this .getLocation ( ) .getFile ( ) .getRelativePath ( ) and
230232 caller = call .getWorkflow ( ) and
231- not caller .hasSingleTrigger ( "pull_request" )
233+ caller .isPrivileged ( )
232234 )
235+ or
236+ // The Workflow has multiple triggers so at least one is ont "pull_request"
237+ count ( this .getATriggerEvent ( ) ) > 1
233238 }
234239}
235240
0 commit comments