Actions lockfiles: require repository identity

Author: nodeselector

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -2,4 +2,5 @@
 category: feature
 ---
 * GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
-  provides access to their YAML abstract syntax trees and structurally valid workflow pins.
+  provides access to their YAML abstract syntax trees and workflow pins with positive owner and
+  repository IDs and a full commit digest.

actions/ql/lib/codeql/actions/Lock.qll

@@ -9,8 +9,9 @@ class ActionsLock extends YamlDocument {
   ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
 
   /**
-   * Holds if the lockfile records `nwo` at `ref` for `workflowPath` with a full commit digest.
-   * Repository pins also cover sub-actions such as `actions/cache/save`.
+   * Holds if the lockfile records `nwo` at `ref` for `workflowPath` with positive owner and
+   * repository IDs and a full commit digest. Repository pins also cover sub-actions such as
+   * `actions/cache/save`.
    */
   bindingset[nwo]
   predicate pins(string workflowPath, string nwo, string ref) {
@@ -32,6 +33,8 @@ class ActionsLock extends YamlDocument {
       ) and
       root.lookup("dependencies").(YamlMapping).lookup(pin) = dependency and
       dependency.lookup("ref").(YamlScalar).getValue() = ref and
+      dependency.lookup("owner_id").(YamlScalar).getValue().toInt() > 0 and
+      dependency.lookup("repo_id").(YamlScalar).getValue().toInt() > 0 and
       dependency
           .lookup("commit")
           .(YamlScalar)

actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `actions/unpinned-tag` query no longer reports action references pinned by a structurally valid `.github/workflows/actions.lock` entry for the enclosing workflow.
+* The `actions/unpinned-tag` query no longer reports action references pinned by a `.github/workflows/actions.lock` entry with positive owner and repository IDs and a full commit digest for the enclosing workflow.

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/actions.lock

@@ -5,6 +5,8 @@ workflows:
     - mismatched/action@v1
     - malformed/action@v1
     - missing/action@v1
+    - missing-owner/action@v1
+    - zero-repo/action@v1
   .github/workflows/other.yml:
     - other-workflow/action@v1
 dependencies:
@@ -28,3 +30,12 @@ dependencies:
     commit: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
     owner_id: 5
     repo_id: 6
+  missing-owner/action@v1:
+    ref: v1
+    commit: sha1-3333333333333333333333333333333333333333
+    repo_id: 7
+  zero-repo/action@v1:
+    ref: v1
+    commit: sha1-4444444444444444444444444444444444444444
+    owner_id: 8
+    repo_id: 0

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/rust-ci.yml

@@ -12,5 +12,7 @@ jobs:
     - uses: mismatched/action@v1 # $ Alert
     - uses: malformed/action@v1 # $ Alert
     - uses: missing/action@v1 # $ Alert
+    - uses: missing-owner/action@v1 # $ Alert
+    - uses: zero-repo/action@v1 # $ Alert
   reusable:
     uses: dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 # $ Alert

actions/ql/test/query-tests/Security/CWE-829-Lockfile/UnpinnedActionsTag.expected

@@ -2,5 +2,7 @@
 | .github/workflows/rust-ci.yml:11:13:11:36 | other-workflow/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'other-workflow/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:11:7:12:4 | Uses Step | Uses Step |
 | .github/workflows/rust-ci.yml:12:13:12:32 | mismatched/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'mismatched/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:12:7:13:4 | Uses Step | Uses Step |
 | .github/workflows/rust-ci.yml:13:13:13:31 | malformed/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'malformed/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:13:7:14:4 | Uses Step | Uses Step |
-| .github/workflows/rust-ci.yml:14:13:14:29 | missing/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:14:7:15:2 | Uses Step | Uses Step |
-| .github/workflows/rust-ci.yml:16:11:16:66 | dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 | Job $@ in 'rust-ci.yml' uses reusable workflow 'dtolnay/rust-toolchain/.github/workflows/reusable.yml' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:16:5:16:77 | Job: reusable | Job: reusable |
+| .github/workflows/rust-ci.yml:14:13:14:29 | missing/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:14:7:15:4 | Uses Step | Uses Step |
+| .github/workflows/rust-ci.yml:15:13:15:35 | missing-owner/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing-owner/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:15:7:16:4 | Uses Step | Uses Step |
+| .github/workflows/rust-ci.yml:16:13:16:31 | zero-repo/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'zero-repo/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:16:7:17:2 | Uses Step | Uses Step |
+| .github/workflows/rust-ci.yml:18:11:18:66 | dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 | Job $@ in 'rust-ci.yml' uses reusable workflow 'dtolnay/rust-toolchain/.github/workflows/reusable.yml' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:18:5:18:77 | Job: reusable | Job: reusable |