Actions: imprecise action references in model data

Beginne mit actions/ql/lib/ext/generated/composite-actions/airbytehq_airbyte.model.yml und vergleiche dessen Repository-Referenz mit der verknüpften .github/actions/run-airbyte-ci/action.yml. Untersuche andere generierte Modelldateien, die als "generated" gekennzeichnet sind, um festzustellen, ob dasselbe Pfadproblem weit verbreitet ist; erledigt ist die Aufgabe, wenn generierte Einträge die spezifische verschachtelte Action identifizieren, die jedes Input enthält.

First of all, thanks for your hard work! I'm a huge fan of CodeQL, and I think support for GitHub Actions within it is amazing.

I'm filing this because I recently tried to consume some of CodeQL's "models" in an external tool (https://github.com/zizmorcore/zizmor/pull/849), and noticed what I think is a model imprecision/data quality issue.

Description

For example, actions/ql/lib/ext/generated/composite-actions/airbytehq_airbyte.model.yml:

extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: actionsSinkModel
    data:
     - ["airbytehq/airbyte", "*", "input.options", "code-injection", "generated"]
     - ["airbytehq/airbyte", "*", "input.subcommand", "code-injection", "generated"]

(Permalink)

This implies that airbytehq/airbyte has a top-level action.ya?ml definition, but it doesn't: instead, it has a set of actions defined under airbytehq/airbyte/.github/actions, of which run-airbyte-ci appears to have the relevant injectable inputs:

name: "Run Dagger pipeline"
description: "Runs a given dagger pipeline"
inputs:
  subcommand:
    description: "Subcommand for airbyte-ci"
    required: true

(Permalink)

This appears to be true in most other model files in that directory, at least the ones marked with "generated" in their definitions.

Expected behavior

Given that the inputs in question occur in in an action that isn't at the repository root, I expected the model YAML to look roughly like this:

extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: actionsSinkModel
    data:
     - ["airbytehq/airbyte/.github/actions/run-airbyte-ci", "*", "input.options", "code-injection", "generated"]
     - ["airbytehq/airbyte/.github/actions/run-airbyte-ci", "*", "input.subcommand", "code-injection", "generated"]

Actual behavior

The model YAML lists airbytehq/airbyte, leaving it unclear which actions within that repository have the injectable inputs.