Add way to customize environmentCheck Actions QL

actions/ql/lib/codeql/actions/config/Config.qll

@@ -164,3 +164,12 @@ predicate untrustedGhCommandDataModel(string cmd_regex, string flag) {
 predicate actionsPermissionsDataModel(string action, string permission) {
   Extensions::actionsPermissionsDataModel(action, permission)
 }
+
+/**
+ * MaD models for deployment environments
+ * Fields:
+ *    - name: deployment environment name, e.g. `Public CI`
+ */
+predicate enabledDeploymentEnvironmentDataModel(string name) {
+  Extensions::enabledDeploymentEnvironmentDataModel(name)
+}

actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

@@ -88,3 +88,10 @@ extensible predicate untrustedGhCommandDataModel(string cmd_regex, string flag);
  * - see https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token for documentation of token permissions.
  */
 extensible predicate actionsPermissionsDataModel(string action, string permission);
+
+/**
+ * Holds for deployment environments that exist for a given repository.
+ * Requires this to be externally supplied but once done can be used to
+ * toggle precision of whether that suffices or not as a control check.
+ */
+extensible predicate enabledDeploymentEnvironmentDataModel(string name);

actions/ql/lib/codeql/actions/security/ControlChecks.qll

@@ -277,6 +277,13 @@ abstract class LabelCheck extends ControlCheck {
 }
 
 class EnvironmentCheck extends ControlCheck instanceof Environment {
+  EnvironmentCheck() {
+    // if there are any custom tuples use those
+    if enabledDeploymentEnvironmentDataModel(_)
+    then enabledDeploymentEnvironmentDataModel(this.(Environment).getName())
+    else this instanceof Environment
+  }
+
   // Environment checks are not effective against any mutable attacks
   // they do actually protect against untrusted code execution (sha)
   override predicate protectsCategoryAndEvent(string category, string event) {

actions/ql/lib/ext/config/deployment_environment.yml

@@ -0,0 +1,5 @@
+extensions:
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: enabledDeploymentEnvironmentDataModel
+    data: []

actions/ql/test/library-tests/basic/.github/workflows/controlcheck.yml

@@ -0,0 +1,16 @@
+on:
+  pull_request_target:
+    types: [Created]
+jobs:
+  test1:
+    environment: EnvironmentInRepo
+    runs-on: ubuntu-latest
+    steps:
+      - name: Test 1
+        run: echo "test1"
+  test2:
+    environment: EnvironmentNotInRepo
+    runs-on: ubuntu-latest
+    steps:
+      - name: Test 2
+        run: echo "test2"

actions/ql/test/library-tests/basic/controlchecktest.expected

@@ -0,0 +1 @@
+| .github/workflows/controlcheck.yml:6:18:6:34 | EnvironmentInRepo |

actions/ql/test/library-tests/basic/controlchecktest.ext.yml

@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: enabledDeploymentEnvironmentDataModel
+    data: 
+      # assumed to exist in a repo where controlcheck.yml exists
+      # realisitically would need to be manually/externally provided
+      - ["EnvironmentInRepo"]

actions/ql/test/library-tests/basic/controlchecktest.ql

@@ -0,0 +1,5 @@
+import actions
+import codeql.actions.security.ControlChecks
+
+from ControlCheck c
+select c