Merge branch 'main' into redsun82-rust-analyzer-update

Resolve `.expected` conflicts in CWE-312/CWE-770 by regenerating against
the merged tree. Migrate the new `core::fmt::Write` model rows to
angle-bracket canonical path form to match main's trait-canonical-paths
change, restoring the m4/m5 cleartext-logging flows.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 890cb55d-0437-4bd7-9268-87b8897ada01

Author: redsun82

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.6.0
+
+### Breaking Changes
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) were split out of `ActorIfCheck` into a new class `EventActorIfCheck`. The `ActorIfCheck` class now only covers `github.actor` and `github.triggering_actor`.
+
+### Minor Analysis Improvements
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an environment is no longer a sufficient sanitizer.
+
 ## 0.5.0
 
 ### Breaking Changes

actions/ql/lib/change-notes/2026-07-22-environment-check-sanitizer-mad.md

@@ -0,0 +1,10 @@
+## 0.6.0
+
+### Breaking Changes
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) were split out of `ActorIfCheck` into a new class `EventActorIfCheck`. The `ActorIfCheck` class now only covers `github.actor` and `github.triggering_actor`.
+
+### Minor Analysis Improvements
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an environment is no longer a sufficient sanitizer.

actions/ql/lib/change-notes/2026-08-17-actor-if-check-event-validity.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.6.0

actions/ql/lib/change-notes/2026-08-18-split-event-actor-if-check.md

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.5.1-dev
+version: 0.6.1-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/lib/change-notes/released/0.6.0.md

@@ -1,3 +1,9 @@
+## 0.6.34
+
+### Minor Analysis Improvements
+
+* The `actions/unpinned-tag` query now detects mutable references to reusable workflows.
+
 ## 0.6.33
 
 ### Query Metadata Changes

actions/ql/lib/codeql-pack.release.yml

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 0.6.34
+
+### Minor Analysis Improvements
+
 * The `actions/unpinned-tag` query now detects mutable references to reusable workflows.

actions/ql/lib/qlpack.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.33
+lastReleaseVersion: 0.6.34