actions/unpinned-tag: match lockfile pins case-insensitively on owner/repo

The lockfile generator lower-cases owner/repo (GitHub treats them case-insensitively) while preserving the ref, so a mixed-case ref such as `uses: Azure/login@v1` never matched the lowercase pinnedByLockfileDataModel row and was still reported as unpinned. Lower-case nwo only for the data-model lookup, keeping source casing in the alert message. Adds a mixed-case suppression test plus a mixed-case control that must still fire.

Author: nodeselector

actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

@@ -44,8 +44,14 @@ private predicate isSelfRepository(string nwo) { nwo.matches("$/%") }
 // predicate is populated by the CodeQL Actions extractor when it parses the lockfile at
 // database-creation time; until then this is a clean no-op and no lockfile-pinned refs are
 // suppressed. See `pinnedByLockfileDataModel` in `ConfigExtensions.qll` for the intended shape.
+bindingset[nwo]
 private predicate pinnedByLockfile(UsesStep uses, string nwo, string version) {
-  pinnedByLockfileDataModel(uses.getLocation().getFile().getRelativePath(), nwo, version)
+  // The lockfile generator lower-cases owner/repo (GitHub treats them
+  // case-insensitively) but preserves the ref, so match `nwo` case-insensitively
+  // and `version` exactly. `nwo` keeps its source casing everywhere else (e.g. the
+  // alert message) so authors still see the ref as written.
+  pinnedByLockfileDataModel(uses.getLocation().getFile().getRelativePath(), nwo.toLowerCase(),
+    version)
 }
 
 private predicate getStepContainerName(UsesStep uses, string name) {

actions/ql/test/query-tests/Security/CWE-829/.github/workflows/lockfile_pinned.yml

@@ -15,3 +15,11 @@ jobs:
     # Negative control is provided for free by the many other fixtures in this directory whose tag
     # refs are NOT recorded in the data extension and therefore remain reported.
     - uses: some-owner/pinned-action@v1
+    # `Mixed-Owner/Pinned-Action@v1` is pinned by the lockfile too, but written with the mixed-case
+    # owner/repo that authors commonly use (Azure, GoogleCloudPlatform, ...). The generator emits
+    # the lockfile nwo lower-cased, so the query must match owner/repo case-insensitively; this ref
+    # is therefore expected to be suppressed (no finding).
+    - uses: Mixed-Owner/Pinned-Action@v1
+    # Negative control: a mixed-case ref that is NOT recorded in the lockfile data must still be
+    # reported, guarding against over-suppression of every mixed-case ref.
+    - uses: Mixed-Owner/Unpinned-Action@v2

actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.expected

@@ -17,6 +17,7 @@
 | .github/workflows/label_trusted_checkout2.yml:21:13:21:36 | completely/fakeaction@v2 | Unpinned 3rd party Action 'label_trusted_checkout2.yml' step $@ uses 'completely/fakeaction' with ref 'v2', not a pinned commit hash | .github/workflows/label_trusted_checkout2.yml:21:7:25:4 | Uses Step | Uses Step |
 | .github/workflows/label_trusted_checkout2.yml:25:13:25:37 | fakerepo/comment-on-pr@v1 | Unpinned 3rd party Action 'label_trusted_checkout2.yml' step $@ uses 'fakerepo/comment-on-pr' with ref 'v1', not a pinned commit hash | .github/workflows/label_trusted_checkout2.yml:25:7:28:21 | Uses Step | Uses Step |
 | .github/workflows/level0.yml:36:15:36:47 | rlespinasse/github-slug-action@v4 | Unpinned 3rd party Action 'Poutine Level 0' step $@ uses 'rlespinasse/github-slug-action' with ref 'v4', not a pinned commit hash | .github/workflows/level0.yml:36:9:39:6 | Uses Step | Uses Step |
+| .github/workflows/lockfile_pinned.yml:25:13:25:42 | Mixed-Owner/Unpinned-Action@v2 | Unpinned 3rd party Action 'lockfile_pinned.yml' step $@ uses 'Mixed-Owner/Unpinned-Action' with ref 'v2', not a pinned commit hash | .github/workflows/lockfile_pinned.yml:25:7:25:43 | Uses Step | Uses Step |
 | .github/workflows/mend.yml:31:15:31:34 | ruby/setup-ruby@v1 | Unpinned 3rd party Action 'Test' step $@ uses 'ruby/setup-ruby' with ref 'v1', not a pinned commit hash | .github/workflows/mend.yml:29:9:33:28 | Uses Step | Uses Step |
 | .github/workflows/pr-workflow.yml:60:15:60:52 | amannn/action-semantic-pull-request@v5 | Unpinned 3rd party Action 'pr-workflow' step $@ uses 'amannn/action-semantic-pull-request' with ref 'v5', not a pinned commit hash | .github/workflows/pr-workflow.yml:60:9:70:6 | Uses Step | Uses Step |
 | .github/workflows/pr-workflow.yml:109:15:109:42 | actionsdesk/lfs-warning@v3.2 | Unpinned 3rd party Action 'pr-workflow' step $@ uses 'actionsdesk/lfs-warning' with ref 'v3.2', not a pinned commit hash | .github/workflows/pr-workflow.yml:109:9:124:6 | Uses Step | Uses Step |

actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected

@@ -138,6 +138,8 @@ edges
 | .github/workflows/level0.yml:122:9:125:6 | Uses Step | .github/workflows/level0.yml:125:9:129:6 | Uses Step |
 | .github/workflows/level0.yml:125:9:129:6 | Uses Step | .github/workflows/level0.yml:129:9:133:6 | Uses Step |
 | .github/workflows/level0.yml:129:9:133:6 | Uses Step | .github/workflows/level0.yml:133:9:135:23 | Run Step |
+| .github/workflows/lockfile_pinned.yml:17:7:22:4 | Uses Step | .github/workflows/lockfile_pinned.yml:22:7:25:4 | Uses Step |
+| .github/workflows/lockfile_pinned.yml:22:7:25:4 | Uses Step | .github/workflows/lockfile_pinned.yml:25:7:25:43 | Uses Step |
 | .github/workflows/mend.yml:13:9:22:6 | Run Step: set_ref | .github/workflows/mend.yml:22:9:29:6 | Uses Step |
 | .github/workflows/mend.yml:22:9:29:6 | Uses Step | .github/workflows/mend.yml:29:9:33:28 | Uses Step |
 | .github/workflows/poc2.yml:28:9:37:6 | Uses Step: branch-deploy | .github/workflows/poc2.yml:37:9:42:6 | Uses Step |

actions/ql/test/query-tests/Security/CWE-829/pinned_by_lockfile.model.yml

@@ -8,3 +8,6 @@ extensions:
     # query suppresses it.
     data:
       - [".github/workflows/lockfile_pinned.yml", "some-owner/pinned-action", "v1"]
+      # Lower-cased form of `Mixed-Owner/Pinned-Action@v1`, as the generator emits it. Exercises the
+      # case-insensitive owner/repo match in the `actions/unpinned-tag` query.
+      - [".github/workflows/lockfile_pinned.yml", "mixed-owner/pinned-action", "v1"]