Actions: Do not treat job.workflow_* as untrusted input

actions/ql/lib/change-notes/2026-10-14-job-workflow-identity-source.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `job.workflow_ref`, `job.workflow_sha`, `job.workflow_repository` and `job.workflow_file_path` context properties are no longer treated as untrusted input in a reusable workflow with no known caller, which removes `actions/untrusted-checkout/medium` false positives on a reusable workflow that checks out its own source.

actions/ql/lib/codeql/actions/dataflow/FlowSources.qll

@@ -225,7 +225,9 @@ class GitHubEventJsonSource extends RemoteFlowSource {
         or
         not exists(e.getATriggerEvent()) and
         event = "unknown" and
-        untrustedEventPropertiesDataModel(_, _)
+        untrustedEventPropertiesDataModel(_, _) and
+        not normalizeExpr(e.getExpression())
+            .regexpMatch("(?i)job\\.workflow_(ref|sha|repository|file_path)")
       ) and
       flag = "json"
     )

actions/ql/test/query-tests/Security/CWE-829/.github/workflows/reusable_workflow_self_checkout.yml

@@ -0,0 +1,11 @@
+on:
+  workflow_call:
+
+jobs:
+  checkout:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}