Use inline expectations for Actions test

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: redsun82

actions/ql/lib/codeql/actions/test/InlineExpectationsTestQuery.ql

@@ -0,0 +1,23 @@
+/**
+ * @kind test-postprocess
+ */
+
+private import actions
+private import codeql.Locations
+private import codeql.files.FileSystem
+private import codeql.util.test.InlineExpectationsTest as T
+private import codeql.actions.test.internal.InlineExpectationsTestImpl
+import T::TestPostProcessing
+import T::TestPostProcessing::Make<Impl, Input>
+
+private module Input implements T::TestPostProcessing::InputSig<Impl> {
+  string getRelativeUrl(Location location) {
+    exists(File f, int startline, int startcolumn, int endline, int endcolumn |
+      location.hasLocationInfo(_, startline, startcolumn, endline, endcolumn) and
+      f = location.getFile()
+    |
+      result =
+        f.getRelativePath() + ":" + startline + ":" + startcolumn + ":" + endline + ":" + endcolumn
+    )
+  }
+}

actions/ql/lib/codeql/actions/test/internal/InlineExpectationsTestImpl.qll

@@ -0,0 +1,13 @@
+private import codeql.Locations as L
+private import codeql.actions.ast.internal.Yaml
+private import codeql.util.test.InlineExpectationsTest
+
+module Impl implements InlineExpectationsTestSig {
+  class ExpectationComment extends YamlNode {
+    ExpectationComment() { this.toString().matches("%$ %") }
+
+    string getContents() { result = "$ " + this.toString().regexpCapture(".*\\$ (.*)", 1) }
+  }
+
+  class Location = L::Location;
+}

actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/.github/workflows/unpinned_first_party.yml

@@ -6,8 +6,8 @@ jobs:
     steps:
       # `actions` is distrusted via `!actions`, and this action is not immutable,
       # so this unpinned tag is reported.
-      - uses: actions/first-interaction@v1
+      - uses: actions/first-interaction@v1 # $ Alert
       # `github` remains trusted, so this unpinned tag is not reported.
       - uses: github/issue-labeler@v3.0
       # Third-party owner is always reported.
-      - uses: foo/bar@v1
+      - uses: foo/bar@v1 # $ Alert

actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.expected

@@ -1,2 +1,2 @@
 | .github/workflows/unpinned_first_party.yml:9:15:9:42 | actions/first-interaction@v1 | Unpinned 3rd party Action 'Unpinned first-party actions' step $@ uses 'actions/first-interaction' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_first_party.yml:9:9:11:6 | Uses Step | Uses Step |
-| .github/workflows/unpinned_first_party.yml:13:15:13:24 | foo/bar@v1 | Unpinned 3rd party Action 'Unpinned first-party actions' step $@ uses 'foo/bar' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_first_party.yml:13:9:13:25 | Uses Step | Uses Step |
+| .github/workflows/unpinned_first_party.yml:13:15:13:24 | foo/bar@v1 | Unpinned 3rd party Action 'Unpinned first-party actions' step $@ uses 'foo/bar' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_first_party.yml:13:9:13:35 | Uses Step | Uses Step |

actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.qlref

@@ -1 +1,2 @@
-Security/CWE-829/UnpinnedActionsTag.ql
+query: Security/CWE-829/UnpinnedActionsTag.ql
+postprocess: codeql/actions/test/InlineExpectationsTestQuery.ql