[actions] Alternate actions/checkout paths suppress untrusted-checkout alerts

Commencez par ActionsMutableRefCheckout.getPath() et ActionsSHACheckout.getPath() dans actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll, puis comparez-les avec LocalScriptExecutionRunStep.getPath() dans PoisonableSteps.qll. Utilisez le reproducer lié pour vérifier le décalage actuel, ajoutez une couverture de régression pour les formes de chemin listées et confirmez que les requêtes Critical et High signalent les cas avec des chemins alternatifs, tandis que le checkout immuable reste non signalé.

Description of the issue

actions/untrusted-checkout/critical does not report a privileged workflow that checks out an untrusted PR into a non-default path: and then executes a script or local action from that checkout. The actions/untrusted-checkout/high fallback is also suppressed, so neither query reports the workflow.

Minimal reproducer

on: pull_request_target

permissions:
  contents: write

jobs:
  execute:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
          path: candidate
      - run: bash candidate/proof.sh

actions/checkout places path: candidate under $GITHUB_WORKSPACE, so this executes the same checked-out script relationship as a default checkout followed by bash proof.sh.

Reproduction

The complete reproducer is in public fork PR #1.

• Latest-release fork CI: CodeQL Action 4.37.1, CLI 2.26.1, codeql/actions-queries 0.6.31
• Current-main CI: queries compiled directly from github/codeql@14450f5bf38ea9a3ce2e0e45dcf51c0bbdd01af5

Both successful runs scanned all 11 workflow files and produced the same result matrix:

The CI also executed harmless script and composite-action canaries through the tested paths before analysis.

Expected result

The alternate-path cases should be reported by actions/untrusted-checkout/critical, like their default-path controls. A path-representation mismatch should not suppress both the critical query and its high fallback.

Source-level cause

At current main:

• ActionsMutableRefCheckout.getPath() and ActionsSHACheckout.getPath() return explicit checkout paths verbatim.
• LocalScriptExecutionRunStep.getPath() and local-action paths are normalized into GITHUB_WORKSPACE/... form.
• The critical query compares those representations with isSubpath, while the high query suppresses its fallback because the following step is still a PoisonableStep.

Normalizing explicit actions/checkout paths at the checkout model, with regression tests for bare, dot-relative, trailing-slash, and local-action forms, appears to be the smallest fix.