Support distrusting Actions owners via !owner entries

Lets `trustedActionsOwnerDataModel` remove an owner (including the
first-party `actions`, `github` and `advanced-security`) with a
`!`-prefixed entry, so unpinned tags for those Actions are reported by
`actions/unpinned-tag`. Unambiguous because owner names can never start
with `!`.

Closes #22409

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: redsun82

actions/ql/lib/change-notes/2026-08-24-untrusted-actions-owner.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `trustedActionsOwnerDataModel` extensible predicate, used by the `actions/unpinned-tag` query, now supports removing an owner from the trusted set by adding an entry prefixed with `!` (for example, `!github`). This makes it possible to distrust first-party owners (`actions`, `github`, `advanced-security`) so that unpinned tags for their Actions are reported.

actions/ql/lib/codeql/actions/config/Config.qll

@@ -130,9 +130,16 @@ predicate immutableActionsDataModel(string action) { Extensions::immutableAction
  * MaD models for trusted actions owners
  * Fields:
  *    - owner: owner name
+ *
+ * An entry may be prefixed with `!` to remove an owner from the trusted set,
+ * overriding any plain entry for the same owner (for example, `!github` distrusts
+ * the first-party `github` owner). This is unambiguous because GitHub owner names
+ * can never start with `!`.
  */
 predicate trustedActionsOwnerDataModel(string owner) {
-  Extensions::trustedActionsOwnerDataModel(owner)
+  Extensions::trustedActionsOwnerDataModel(owner) and
+  not owner.matches("!%") and
+  not Extensions::trustedActionsOwnerDataModel("!" + owner)
 }
 
 /**

actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/.github/workflows/unpinned_first_party.yml

@@ -0,0 +1,13 @@
+name: Unpinned first-party actions
+on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      # `actions` is distrusted via `!actions`, and this action is not immutable,
+      # so this unpinned tag is reported.
+      - uses: actions/first-interaction@v1
+      # `github` remains trusted, so this unpinned tag is not reported.
+      - uses: github/issue-labeler@v3.0
+      # Third-party owner is always reported.
+      - uses: foo/bar@v1

actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.expected

@@ -0,0 +1,2 @@
+| .github/workflows/unpinned_first_party.yml:9:15:9:42 | actions/first-interaction@v1 | Unpinned 3rd party Action 'Unpinned first-party actions' step $@ uses 'actions/first-interaction' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_first_party.yml:9:9:11:6 | Uses Step | Uses Step |
+| .github/workflows/unpinned_first_party.yml:13:15:13:24 | foo/bar@v1 | Unpinned 3rd party Action 'Unpinned first-party actions' step $@ uses 'foo/bar' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_first_party.yml:13:9:13:25 | Uses Step | Uses Step |

actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.ext.yml

@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: trustedActionsOwnerDataModel
+    data:
+      # Distrust the first-party `actions` owner so unpinned tags for its
+      # Actions are reported. `github` is intentionally left trusted.
+      - ["!actions"]

actions/ql/test/query-tests/Security/CWE-829-untrusted-owner/UnpinnedActionsTag.qlref

@@ -0,0 +1 @@
+Security/CWE-829/UnpinnedActionsTag.ql

docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst

@@ -83,3 +83,22 @@ To allow any Action from the publisher ``octodemo``, such as ``octodemo/3rd-part
 3. Ensure that the model pack is included in your CodeQL analysis.
 
 By following these steps, you will add ``octodemo`` to the list of trusted Action publishers, and the query will no longer generate security alerts for unpinned tags from this publisher.  For more information, see `Extending CodeQL coverage with CodeQL model packs in default setup <https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#extending-codeql-coverage-with-codeql-model-packs-in-default-setup>`_ and `Creating and working with CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack>`_.
+
+Example: Remove a trusted Actions publisher for the ``actions/unpinned-tag`` query
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+GitHub's own organizations (``actions``, ``github`` and ``advanced-security``) are trusted by default. If you want unpinned tags for these first-party Actions to be reported as well, you can remove an owner from the trusted list by adding an entry prefixed with ``!``. A ``!`` entry always takes precedence over a plain entry for the same owner.
+
+To distrust the first-party ``github`` owner, add a data extension file with the following content:
+
+.. code-block:: yaml
+
+   extensions:
+     - addsTo:
+         pack: codeql/actions-all
+         extensible: trustedActionsOwnerDataModel
+       data:
+         - ["!github"]
+
+With this in place, the query will once again report unpinned tags for Actions published by ``github``.
+