Add Minimum Permissions Map

actions/ql/lib/codeql/actions/config/Config.qll

@@ -126,6 +126,18 @@ predicate vulnerableActionsDataModel(
  */
 predicate immutableActionsDataModel(string action) { Extensions::immutableActionsDataModel(action) }
 
+/**
+ * MaD models for minimum permissions for actions
+ * Fields:
+ *    - action: action name
+ *    - minimum_permissions: list of minimum permissions
+ */
+predicate minimumPermissionsDataModel(
+  string action, string minimum_permissions
+) {
+  Extensions::minimumPermissionsDataModel(action, minimum_permissions)
+}
+
 /**
  * MaD models for untrusted git commands
  * Fields:

actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

@@ -63,6 +63,11 @@ extensible predicate vulnerableActionsDataModel(
  */
 extensible predicate immutableActionsDataModel(string action);
 
+/**
+ * Holds for actions that have a minimum permissions definition.
+ */
+extensible predicate minimumPermissionsDataModel(string action, string minimum_permissions);
+
 /**
  * Holds for git commands that may introduce untrusted data when called on an attacker controlled branch.
  */

actions/ql/lib/codeql/actions/security/MinimumActionsPermissions.qll

@@ -0,0 +1,14 @@
+import actions
+class MinimumActionsPermissions extends UsesStep {
+  string action;
+  string minimum_permissions;
+
+  MinimumActionsPermissions() {
+    minimumPermissionsDataModel(action, minimum_permissions) and
+    this.getCallee() = action
+  }
+
+  string getMinimumPermissions() { result = minimum_permissions }
+
+  string getAction() { result = action }
+}