diff --git a/actions/extractor/tools/autobuild-impl.ps1 b/actions/extractor/tools/autobuild-impl.ps1
index e232cd3cc545..00e0bcda84fd 100644
--- a/actions/extractor/tools/autobuild-impl.ps1
+++ b/actions/extractor/tools/autobuild-impl.ps1
@@ -1,13 +1,11 @@
-# Note: We're adding the `reusable_workflows` subdirectories to proactively
-# record workflows that were called cross-repo, check them out locally,
-# and enable an interprocedural analysis across the workflow files.
-# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
+# Include downloaded external reusable workflows to enable interprocedural analysis.
+# These workflows are stored below a generated UUID directory at the repository root.
 $DefaultPathFilters = @(
     'exclude:**/*',
     'include:.github/workflows/*.yml',
     'include:.github/workflows/*.yaml',
-    'include:.github/reusable_workflows/**/*.yml',
-    'include:.github/reusable_workflows/**/*.yaml',
+    'include:9466014afba34ef28239871ceabf4132/**/*.yml',
+    'include:9466014afba34ef28239871ceabf4132/**/*.yaml',
     'include:**/action.yml',
     'include:**/action.yaml'
 )
diff --git a/actions/extractor/tools/autobuild.sh b/actions/extractor/tools/autobuild.sh
index f2cbb7ddfa7e..eb2cbd45cffd 100755
--- a/actions/extractor/tools/autobuild.sh
+++ b/actions/extractor/tools/autobuild.sh
@@ -2,16 +2,14 @@
 
 set -eu
 
-# Note: We're adding the `reusable_workflows` subdirectories to proactively
-# record workflows that were called cross-repo, check them out locally,
-# and enable an interprocedural analysis across the workflow files.
-# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
+# Include downloaded external reusable workflows to enable interprocedural analysis.
+# These workflows are stored below a generated UUID directory at the repository root.
 DEFAULT_PATH_FILTERS=$(cat << END
 exclude:**/*
 include:.github/workflows/*.yml
 include:.github/workflows/*.yaml
-include:.github/reusable_workflows/**/*.yml
-include:.github/reusable_workflows/**/*.yaml
+include:9466014afba34ef28239871ceabf4132/**/*.yml
+include:9466014afba34ef28239871ceabf4132/**/*.yaml
 include:**/action.yml
 include:**/action.yaml
 END
diff --git a/actions/extractor/tools/baseline-config.json b/actions/extractor/tools/baseline-config.json
index fde0bd1ecdff..1e1761803e8b 100644
--- a/actions/extractor/tools/baseline-config.json
+++ b/actions/extractor/tools/baseline-config.json
@@ -2,8 +2,8 @@
     "paths": [
         ".github/workflows/*.yml",
         ".github/workflows/*.yaml",
-        ".github/reusable_workflows/**/*.yml",
-        ".github/reusable_workflows/**/*.yaml",
+        "9466014afba34ef28239871ceabf4132/**/*.yml",
+        "9466014afba34ef28239871ceabf4132/**/*.yaml",
         "**/action.yml",
         "**/action.yaml"
     ]
diff --git a/actions/ql/lib/codeql/actions/Helper.qll b/actions/ql/lib/codeql/actions/Helper.qll
index 348ec75a5193..2291915b7a6b 100644
--- a/actions/ql/lib/codeql/actions/Helper.qll
+++ b/actions/ql/lib/codeql/actions/Helper.qll
@@ -48,14 +48,9 @@ string getRepoRoot() {
       w.getLocation()
           .getFile()
           .getRelativePath()
-          .prefix(w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") + 1) and
-    // exclude workflow_enum reusable workflows directory root
-    not result.indexOf(".github/workflows/external/") > -1 and
-    not result.indexOf(".github/actions/external/") > -1
+          .prefix(w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") + 1)
     or
     not w.getLocation().getFile().getRelativePath().indexOf("/.github/workflows") > 0 and
-    not w.getLocation().getFile().getRelativePath().indexOf(".github/workflows/external/") > -1 and
-    not w.getLocation().getFile().getRelativePath().indexOf(".github/actions/external/") > -1 and
     result = ""
   )
 }
diff --git a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll
index 82d4a1186708..3a308e88a7d7 100644
--- a/actions/ql/lib/codeql/actions/ast/internal/Ast.qll
+++ b/actions/ql/lib/codeql/actions/ast/internal/Ast.qll
@@ -372,6 +372,14 @@ class ExpressionImpl extends AstNodeImpl, TExpressionNode {
   }
 }
 
+bindingset[owner, repo, action_path]
+private string externalCompositeActionName(string owner, string repo, string action_path) {
+  action_path.trim() = "" and result = owner.trim() + "/" + repo.trim()
+  or
+  not action_path.trim() = "" and
+  result = owner.trim() + "/" + repo.trim() + "/" + action_path.trim()
+}
+
 class CompositeActionImpl extends AstNodeImpl, TCompositeAction {
   YamlMapping n;
 
@@ -415,7 +423,33 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction {
     )
   }
 
+  /**
+   * Holds if this composite action is described by an external composite action model with the
+   * given repository, action, revision, and local path details.
+   */
+  predicate hasExternalCompositeActionModel(
+    string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha,
+    string local_path
+  ) {
+    externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha,
+      local_path) and
+    local_path.trim() = this.getLocation().getFile().getRelativePath()
+  }
+
+  /** Holds if this composite action was downloaded from an external repository. */
+  predicate isExternalCompositeAction() {
+    this.hasExternalCompositeActionModel(_, _, _, _, _, _)
+    or
+    this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%")
+  }
+
   string getResolvedPath() {
+    exists(string owner, string repo, string action_path, string requested_ref |
+      this.hasExternalCompositeActionModel(owner, repo, action_path, requested_ref, _, _) and
+      result = externalCompositeActionName(owner, repo, action_path) + "@" + requested_ref.trim()
+    )
+    or
+    not this.isExternalCompositeAction() and
     result =
       ["", "./"] +
         this.getLocation()
@@ -424,7 +458,6 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction {
             .replaceAll(getRepoRoot(), "")
             .replaceAll("/action.yml", "")
             .replaceAll("/action.yaml", "")
-            .replaceAll(".github/actions/external/", "")
   }
 
   private predicate hasExplicitSecretAccess() {
@@ -542,14 +575,36 @@ class ReusableWorkflowImpl extends AstNodeImpl, WorkflowImpl {
     )
   }
 
+  /**
+   * Holds if this reusable workflow is described by an external reusable workflow model with the
+   * given repository, workflow, revision, and local path details.
+   */
+  predicate hasExternalReusableWorkflowModel(
+    string owner, string repo, string workflow_path, string requested_ref,
+    string resolved_commit_sha, string local_path
+  ) {
+    externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref,
+      resolved_commit_sha, local_path) and
+    local_path.trim() = this.getLocation().getFile().getRelativePath()
+  }
+
+  /** Holds if this reusable workflow was downloaded from an external repository. */
+  predicate isExternalReusableWorkflow() {
+    this.hasExternalReusableWorkflowModel(_, _, _, _, _, _)
+    or
+    this.getLocation().getFile().getRelativePath().matches("9466014afba34ef28239871ceabf4132/%") // root folder for external workflows and composite actions
+  }
+
   string getResolvedPath() {
+    exists(string owner, string repo, string workflow_path, string requested_ref |
+      this.hasExternalReusableWorkflowModel(owner, repo, workflow_path, requested_ref, _, _) and
+      result =
+        owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() + "@" + requested_ref.trim()
+    )
+    or
+    not this.isExternalReusableWorkflow() and
     result =
-      ["", "./"] +
-        this.getLocation()
-            .getFile()
-            .getRelativePath()
-            .replaceAll(getRepoRoot(), "")
-            .replaceAll(".github/workflows/external/", "")
+      ["", "./"] + this.getLocation().getFile().getRelativePath().replaceAll(getRepoRoot(), "")
   }
 }
 
@@ -1336,6 +1391,9 @@ class EnvImpl extends AstNodeImpl, TEnvNode {
 abstract class UsesImpl extends AstNodeImpl {
   abstract string getCallee();
 
+  /** Gets the canonical name used to resolve this `uses` element to its callable target. */
+  abstract string getCallableName();
+
   abstract ScalarValueImpl getCalleeNode();
 
   abstract string getVersion();
@@ -1374,6 +1432,63 @@ class UsesStepImpl extends StepImpl, UsesImpl {
     else result = u.getValue()
   }
 
+  private predicate isWorkspaceLocalCall() { u.getValue().matches(["./%", ".github/%"]) }
+
+  private predicate isSelfCall() { u.getValue().matches("$/%") }
+
+  private predicate isLocalCall() { this.isWorkspaceLocalCall() or this.isSelfCall() }
+
+  private predicate hasModeledExternalCallee() {
+    exists(string owner, string repo, string action_path, string requested_ref |
+      externalCompositeActionDataModel(owner, repo, action_path, requested_ref, _, _) and
+      this.getCallee() = externalCompositeActionName(owner, repo, action_path) and
+      this.getVersion() = requested_ref.trim()
+    )
+  }
+
+  private predicate hasExternalEnclosingCompositeAction() {
+    exists(CompositeActionImpl action |
+      action = this.getEnclosingCompositeAction() and action.isExternalCompositeAction()
+    )
+  }
+
+  private predicate hasModeledExternalEnclosingCompositeAction() {
+    exists(CompositeActionImpl action |
+      action = this.getEnclosingCompositeAction() and
+      action.hasExternalCompositeActionModel(_, _, _, _, _, _)
+    )
+  }
+
+  private string getSelfCallableName() {
+    exists(CompositeActionImpl action, string owner, string repo, string requested_ref |
+      action = this.getEnclosingCompositeAction() and
+      action.hasExternalCompositeActionModel(owner, repo, _, requested_ref, _, _) and
+      result =
+        externalCompositeActionName(owner, repo, this.getCallee().suffix(2)) + "@" +
+          requested_ref.trim()
+    )
+    or
+    not this.hasExternalEnclosingCompositeAction() and
+    result = this.getCallee().suffix(2)
+  }
+
+  override string getCallableName() {
+    this.isWorkspaceLocalCall() and
+    (
+      this.hasModeledExternalEnclosingCompositeAction()
+      or
+      not this.hasExternalEnclosingCompositeAction()
+    ) and
+    result = this.getCallee()
+    or
+    this.isSelfCall() and
+    result = this.getSelfCallableName()
+    or
+    not this.isLocalCall() and
+    this.hasModeledExternalCallee() and
+    result = this.getCallee() + "@" + this.getVersion()
+  }
+
   override ScalarValueImpl getCalleeNode() { result.getNode() = u }
 
   /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
@@ -1388,20 +1503,19 @@ class UsesStepImpl extends StepImpl, UsesImpl {
  * Gets a regular expression that parses an `owner/repo@version` reference within a `uses` field in an Actions job step.
  * local repo: octo-org/this-repo/.github/workflows/workflow-1.yml@172239021f7ba04fe7327647b213799853a9eb89
  * local repo: ./.github/workflows/workflow-2.yml
+ * local repo: $/.github/workflows/workflow-2.yml
  * remote repo: octo-org/another-repo/.github/workflows/workflow.yml@v1
  */
 private string repoUsesParser() { result = "([^/]+)/([^/]+)/([^@]+)@(.+)" }
 
-private string pathUsesParser() { result = "\\./(.+)" }
-
 class ExternalJobImpl extends JobImpl, UsesImpl {
   YamlScalar u;
 
   ExternalJobImpl() { n.lookup("uses") = u }
 
   override string getCallee() {
-    if u.getValue().matches("./%")
-    then result = u.getValue().regexpCapture(pathUsesParser(), 1)
+    if u.getValue().matches(["./%", "$/%"])
+    then result = u.getValue().suffix(2)
     else
       result =
         u.getValue().regexpCapture(repoUsesParser(), 1) + "/" +
@@ -1409,6 +1523,43 @@ class ExternalJobImpl extends JobImpl, UsesImpl {
           u.getValue().regexpCapture(repoUsesParser(), 3)
   }
 
+  private predicate isLocalCall() { u.getValue().matches(["./%", "$/%"]) }
+
+  private predicate hasExternalEnclosingWorkflow() {
+    exists(ReusableWorkflowImpl enclosing_workflow |
+      enclosing_workflow = this.getEnclosingWorkflow() and
+      enclosing_workflow.isExternalReusableWorkflow()
+    )
+  }
+
+  private predicate hasModeledExternalCallee() {
+    exists(string owner, string repo, string workflow_path, string requested_ref |
+      externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, _, _) and
+      this.getCallee() = owner.trim() + "/" + repo.trim() + "/" + workflow_path.trim() and
+      this.getVersion() = requested_ref.trim()
+    )
+  }
+
+  override string getCallableName() {
+    this.isLocalCall() and
+    exists(
+      ReusableWorkflowImpl enclosing_workflow, string owner, string repo, string requested_ref
+    |
+      enclosing_workflow = this.getEnclosingWorkflow() and
+      enclosing_workflow.hasExternalReusableWorkflowModel(owner, repo, _, requested_ref, _, _) and
+      result =
+        owner.trim() + "/" + repo.trim() + "/" + this.getCallee() + "@" + requested_ref.trim()
+    )
+    or
+    this.isLocalCall() and
+    not this.hasExternalEnclosingWorkflow() and
+    result = this.getCallee()
+    or
+    not this.isLocalCall() and
+    this.hasModeledExternalCallee() and
+    result = this.getCallee() + "@" + this.getVersion()
+  }
+
   override ScalarValueImpl getCalleeNode() { result.getNode() = u }
 
   /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
diff --git a/actions/ql/lib/codeql/actions/config/Config.qll b/actions/ql/lib/codeql/actions/config/Config.qll
index e6359c142582..dd1c0073abb9 100644
--- a/actions/ql/lib/codeql/actions/config/Config.qll
+++ b/actions/ql/lib/codeql/actions/config/Config.qll
@@ -16,6 +16,42 @@ predicate workflowDataModel(
   Extensions::workflowDataModel(path, trigger, job, secrets_source, permissions, runner)
 }
 
+/**
+ * MaD models for downloaded external reusable workflows
+ * Fields:
+ *    - owner: Repository owner
+ *    - repo: Repository name
+ *    - workflow_path: Workflow path within the repository
+ *    - requested_ref: Ref used by the caller
+ *    - resolved_commit_sha: Commit to which the ref resolved
+ *    - local_path: Downloaded workflow path within the analyzed repository
+ */
+predicate externalReusableWorkflowDataModel(
+  string owner, string repo, string workflow_path, string requested_ref, string resolved_commit_sha,
+  string local_path
+) {
+  Extensions::externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref,
+    resolved_commit_sha, local_path)
+}
+
+/**
+ * MaD models for downloaded external composite actions
+ * Fields:
+ *    - owner: Repository owner
+ *    - repo: Repository name
+ *    - action_path: Action path within the repository
+ *    - requested_ref: Ref used by the caller
+ *    - resolved_commit_sha: Commit to which the ref resolved
+ *    - local_path: Downloaded action metadata path within the analyzed repository
+ */
+predicate externalCompositeActionDataModel(
+  string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha,
+  string local_path
+) {
+  Extensions::externalCompositeActionDataModel(owner, repo, action_path, requested_ref,
+    resolved_commit_sha, local_path)
+}
+
 /**
  * MaD models for repository details
  * Fields:
diff --git a/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll b/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll
index 87a919359404..6a6ad6b70b16 100644
--- a/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll
+++ b/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll
@@ -9,6 +9,22 @@ extensible predicate workflowDataModel(
   string path, string trigger, string job, string secrets_source, string permissions, string runner
 );
 
+/**
+ * Holds if an external reusable workflow was downloaded for the given reference.
+ */
+extensible predicate externalReusableWorkflowDataModel(
+  string owner, string repo, string workflow_path, string requested_ref, string resolved_commit_sha,
+  string local_path
+);
+
+/**
+ * Holds if an external composite action was downloaded for the given reference.
+ */
+extensible predicate externalCompositeActionDataModel(
+  string owner, string repo, string action_path, string requested_ref, string resolved_commit_sha,
+  string local_path
+);
+
 /**
  * Holds if repository data model exists for the given parameters.
  */
diff --git a/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll b/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll
index cf95292588c3..1ac9e93845b8 100644
--- a/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll
+++ b/actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll
@@ -78,7 +78,7 @@ class DataFlowCall instanceof Cfg::Node {
   /** Gets a textual representation of this element. */
   string toString() { result = super.toString() }
 
-  string getName() { result = super.getAstNode().(Uses).getCallee() }
+  string getName() { result = super.getAstNode().(UsesImpl).getCallableName() }
 
   DataFlowCallable getEnclosingCallable() { result = super.getScope() }
 
diff --git a/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll b/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
index 3d5b8852b850..1af640672025 100644
--- a/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
+++ b/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
@@ -41,7 +41,7 @@ Event getRelevantCachePoisoningEventForSink(DataFlow::Node sink) {
       // the workflow caller runs in the context of the default branch
       result.getName() = "workflow_call" and
       exists(ExternalJob caller |
-        caller.getCallee() = job.getLocation().getFile().getRelativePath() and
+        job.getEnclosingWorkflow().(ReusableWorkflow).getACaller() = caller and
         runsOnDefaultBranch(caller.getATriggerEvent())
       )
     )
diff --git a/actions/ql/lib/ext/config/workflow_runtime_data.yml b/actions/ql/lib/ext/config/workflow_runtime_data.yml
index f02a6bc20aa2..658b1a1f534e 100644
--- a/actions/ql/lib/ext/config/workflow_runtime_data.yml
+++ b/actions/ql/lib/ext/config/workflow_runtime_data.yml
@@ -7,3 +7,11 @@ extensions:
       pack: codeql/actions-all
       extensible: workflowDataModel
     data: []
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: externalReusableWorkflowDataModel
+    data: []
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: externalCompositeActionDataModel
+    data: []
diff --git a/actions/ql/src/change-notes/2026-07-31-external-workflow-models.md b/actions/ql/src/change-notes/2026-07-31-external-workflow-models.md
new file mode 100644
index 000000000000..60be5d93be6e
--- /dev/null
+++ b/actions/ql/src/change-notes/2026-07-31-external-workflow-models.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Update GitHub Actions analysis to model versioned downloaded external reusable workflows and composite actions.
\ No newline at end of file
diff --git a/actions/ql/test/external-reusable-workflows.model.yml b/actions/ql/test/external-reusable-workflows.model.yml
new file mode 100644
index 000000000000..a753501a86ed
--- /dev/null
+++ b/actions/ql/test/external-reusable-workflows.model.yml
@@ -0,0 +1,25 @@
+extensions:
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: externalReusableWorkflowDataModel
+    data:
+      - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v1", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/first.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/second.yml", "v2", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/reusable-workflow.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/publishResults.yml", "master", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/formal.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/build.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/build_nested.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/build_nested_branching.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml"]
+      - ["TestOrg", "TestRepo", ".github/workflows/reusable.yml", "main", "cccccccccccccccccccccccccccccccccccccccc", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml"]
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: externalCompositeActionDataModel
+    data:
+      - ["TestOrg", "Actions", "remote", "v1", "dddddddddddddddddddddddddddddddddddddddd", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml"]
+      - ["TestOrg", "Actions", "remote", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml"]
+      - ["TestOrg", "Actions", ".github/actions/leaf", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml"]
+      - ["TestOrg", "TestRepo", ".github/actions/clone-repo", "main", "1111111111111111111111111111111111111111", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml"]
+      - ["ultralytics", "actions", "", "main", "2222222222222222222222222222222222222222", "9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml"]
diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml b/actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml
new file mode 100644
index 000000000000..0193b01a28a1
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/.github/actions/leaf/action.yml
@@ -0,0 +1,7 @@
+name: Local leaf action
+description: Completes an alternating local and remote action chain
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: echo complete
diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml
new file mode 100644
index 000000000000..e332cc09d146
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v1/action.yml
@@ -0,0 +1,6 @@
+name: Local root action for v1
+description: Calls the v1 external action
+runs:
+  using: composite
+  steps:
+    - uses: TestOrg/Actions/remote@v1
diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml
new file mode 100644
index 000000000000..beaad908416b
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/.github/actions/root-v2/action.yml
@@ -0,0 +1,6 @@
+name: Local root action for v2
+description: Calls the v2 external action
+runs:
+  using: composite
+  steps:
+    - uses: TestOrg/Actions/remote@v2
diff --git a/actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml b/actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml
new file mode 100644
index 000000000000..e9556bc05922
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/.github/workflows/caller.yml
@@ -0,0 +1,12 @@
+name: Call external composite actions through local actions
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/actions/root-v1
+      - uses: ./.github/actions/root-v2
+      - uses: UnmodeledOrg/Actions/remote@main
diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml
new file mode 100644
index 000000000000..cf6368464fd5
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml
@@ -0,0 +1,6 @@
+name: External action at v1
+description: Calls back into the analyzed repository
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/leaf
diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml
new file mode 100644
index 000000000000..8a67d11b7c77
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml
@@ -0,0 +1,7 @@
+name: External leaf action at v2
+description: Completes a self-repository action chain
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: echo complete
\ No newline at end of file
diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml
new file mode 100644
index 000000000000..82d159fab76b
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml
@@ -0,0 +1,6 @@
+name: External action at v2
+description: Calls an action in the same external repository
+runs:
+  using: composite
+  steps:
+    - uses: $/.github/actions/leaf
diff --git a/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ref-0wu7t20oora8i/remote/action.yml b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ref-0wu7t20oora8i/remote/action.yml
new file mode 100644
index 000000000000..4525b936a9f1
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/UnmodeledOrg/Actions/ref-0wu7t20oora8i/remote/action.yml
@@ -0,0 +1,6 @@
+name: Unmodeled external action
+description: Must not create caller or child call edges
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/leaf
diff --git a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected
new file mode 100644
index 000000000000..085661ee61d8
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected
@@ -0,0 +1,6 @@
+| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf |  | .github/actions/leaf/action.yml |
+| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml:6:7:6:35 | Uses Step | $/.github/actions/leaf |  | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml |
+| .github/actions/root-v1/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v1 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml |
+| .github/actions/root-v2/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v2 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml |
+| .github/workflows/caller.yml:10:9:11:6 | Uses Step | ./.github/actions/root-v1 |  | .github/actions/root-v1/action.yml |
+| .github/workflows/caller.yml:11:9:12:6 | Uses Step | ./.github/actions/root-v2 |  | .github/actions/root-v2/action.yml |
diff --git a/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql
new file mode 100644
index 000000000000..2757c758c0ea
--- /dev/null
+++ b/actions/ql/test/library-tests/external-composite-actions/external_composite_actions.ql
@@ -0,0 +1,12 @@
+import actions
+
+string getVersion(UsesStep call) {
+  result = call.getVersion()
+  or
+  not exists(call.getVersion()) and result = ""
+}
+
+from CompositeAction callee, UsesStep caller
+where callee.getACallerStep() = caller
+select caller, caller.getCallee(), getVersion(caller),
+  callee.getLocation().getFile().getRelativePath()
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml
new file mode 100644
index 000000000000..4e4a9d78a337
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/external_reusable_workflow.yml
@@ -0,0 +1,10 @@
+name: Call an external reusable workflow
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  first-v1:
+    uses: TestOrg/TestRepo/.github/workflows/first.yml@v1
+  first-v2:
+    uses: TestOrg/TestRepo/.github/workflows/first.yml@v2
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml
new file mode 100644
index 000000000000..2c132d536a43
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/.github/workflows/unmodeled_external_reusable_workflow.yml
@@ -0,0 +1,8 @@
+name: Call an unmodeled external reusable workflow
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  legacy:
+    uses: LegacyOrg/LegacyRepo/.github/workflows/legacy.yml@main
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/ref-07cp61dt7qne3/.github/workflows/legacy.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/ref-07cp61dt7qne3/.github/workflows/legacy.yml
new file mode 100644
index 000000000000..1a819b60ca89
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/LegacyOrg/LegacyRepo/ref-07cp61dt7qne3/.github/workflows/legacy.yml
@@ -0,0 +1,6 @@
+name: Unmodeled external reusable workflow
+
+on:
+  workflow_call: {}
+
+jobs: {}
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml
new file mode 100644
index 000000000000..f8881b97b90d
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml
@@ -0,0 +1,8 @@
+name: First external reusable workflow
+
+on:
+  workflow_call: {}
+
+jobs:
+  second:
+    uses: ./.github/workflows/second.yml
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml
new file mode 100644
index 000000000000..44bd49f66712
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml
@@ -0,0 +1,10 @@
+name: Second external reusable workflow
+
+on:
+  workflow_call: {}
+
+jobs:
+  complete:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo complete
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml
new file mode 100644
index 000000000000..de52bf33c34a
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml
@@ -0,0 +1,8 @@
+name: First external reusable workflow at v2
+
+on:
+  workflow_call: {}
+
+jobs:
+  second:
+    uses: $/.github/workflows/second.yml
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml
new file mode 100644
index 000000000000..02904995e71c
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml
@@ -0,0 +1,10 @@
+name: Second external reusable workflow at v2
+
+on:
+  workflow_call: {}
+
+jobs:
+  complete:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo complete
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected
new file mode 100644
index 000000000000..c56b6f7978f0
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.expected
@@ -0,0 +1,4 @@
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/second.yml |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml:8:5:8:41 | Job: second | .github/workflows/second.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/second.yml |
+| .github/workflows/external_reusable_workflow.yml:8:5:9:2 | Job: first-v1 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-0wu7t20oora8i/.github/workflows/first.yml |
+| .github/workflows/external_reusable_workflow.yml:10:5:10:58 | Job: first-v2 | TestOrg/TestRepo/.github/workflows/first.yml | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml |
diff --git a/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql
new file mode 100644
index 000000000000..931fc5ca6544
--- /dev/null
+++ b/actions/ql/test/library-tests/external-reusable-workflows/external_reusable_workflows.ql
@@ -0,0 +1,5 @@
+import actions
+
+from ReusableWorkflow callee, ExternalJob caller
+where callee.getACaller() = caller
+select caller, caller.getCallee(), callee.getLocation().getFile().getRelativePath()
diff --git a/actions/ql/test/qlpack.yml b/actions/ql/test/qlpack.yml
index 9c9e714fc67a..0080ce48ba6c 100644
--- a/actions/ql/test/qlpack.yml
+++ b/actions/ql/test/qlpack.yml
@@ -11,4 +11,5 @@ extractor: actions
 tests: .
 warnOnImplicitThis: true
 dataExtensions:
+  - external-reusable-workflows.model.yml
   - output-clobbering.model.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml
rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml
diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml
rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-094/.github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml
rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/ultralytics/actions/action.yaml b/actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-094/.github/actions/external/ultralytics/actions/action.yaml
rename to actions/ql/test/query-tests/Security/CWE-094/9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml
diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected
index 02f7f68c05f4..1cd15f084fcc 100644
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected
@@ -1,4 +1,15 @@
 edges
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance |  |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | provenance |  |
 | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | provenance |  |
 | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | provenance |  |
 | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result2] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result2] | provenance |  |
@@ -8,12 +19,6 @@ edges
 | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | .github/actions/action5/action.yml:20:7:26:4 | Run Step: step [result] | provenance |  |
 | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | .github/actions/action5/action.yml:14:13:14:46 | steps.step2.outputs.result2 | provenance |  |
 | .github/actions/action5/action.yml:28:16:28:45 | github.event.issue.body | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance |  |
-| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | provenance |  |
 | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | provenance |  |
 | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | provenance |  |
 | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | provenance |  |
@@ -49,7 +54,7 @@ edges
 | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | provenance |  |
 | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | provenance |  |
 | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | .github/workflows/composite-action-caller-4.yml:17:21:17:53 | steps.clone.outputs.result | provenance |  |
-| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance |  |
+| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance |  |
 | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | provenance |  |
 | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | provenance |  |
 | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | provenance |  |
@@ -57,11 +62,6 @@ edges
 | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:42:86:42:113 | env.ISSUE_BODY_PARSED | provenance |  |
 | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | provenance |  |
 | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | .github/workflows/cross3.yml:53:89:53:107 | env.pr_message | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance |  |
 | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | .github/workflows/image_link_generator.yml:25:25:25:68 | steps.extract-url.outputs.initial_url | provenance |  |
 | .github/workflows/image_link_generator.yml:18:18:18:49 | github.event.comment.body | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | provenance |  |
 | .github/workflows/image_link_generator.yml:22:9:28:6 | Run Step: curl [redirected_url] | .github/workflows/image_link_generator.yml:31:28:31:67 | steps.curl.outputs.redirected_url | provenance |  |
@@ -99,7 +99,7 @@ edges
 | .github/workflows/reusable-workflow-2.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/reusable-workflow-2.yml:66:34:66:52 | env.prev_log | provenance |  |
 | .github/workflows/reusable-workflow-caller-1.yml:11:15:11:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | provenance |  |
 | .github/workflows/reusable-workflow-caller-2.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-2.yml:6:7:6:11 | input taint | provenance |  |
-| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance |  |
+| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance |  |
 | .github/workflows/schedule_remote_code_injection.yml:12:9:18:6 | Uses Step: issues | .github/workflows/schedule_remote_code_injection.yml:19:21:19:52 | steps.issues.outputs.data | provenance |  |
 | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | .github/workflows/self_needs.yml:20:15:20:51 | needs.test1.outputs.job_output | provenance |  |
 | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | provenance |  |
@@ -223,7 +223,7 @@ edges
 | .github/workflows/test27.yml:35:9:41:6 | Uses Step | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(<ERSION)" \| tee -a $GITHUB_OUTPUT\n | provenance | Config |
 | .github/workflows/test27.yml:41:9:46:2 | Run Step: get-version [chart_version] | .github/workflows/test27.yml:20:23:20:68 | steps.get-version.outputs.chart_version | provenance |  |
 | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(<ERSION)" \| tee -a $GITHUB_OUTPUT\n | .github/workflows/test27.yml:41:9:46:2 | Run Step: get-version [chart_version] | provenance |  |
-| .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | provenance |  |
+| .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | provenance |  |
 | .github/workflows/test.yml:11:7:13:4 | Job outputs node [job_output] | .github/workflows/test.yml:52:20:52:56 | needs.job1.outputs['job_output'] | provenance |  |
 | .github/workflows/test.yml:11:20:11:50 | steps.step5.outputs.MSG5 | .github/workflows/test.yml:11:7:13:4 | Job outputs node [job_output] | provenance |  |
 | .github/workflows/test.yml:17:9:23:6 | Uses Step: step0 [value] | .github/workflows/test.yml:25:18:25:48 | steps.step0.outputs.value | provenance |  |
@@ -242,6 +242,25 @@ edges
 | .github/workflows/untrusted_checkout1.yml:11:9:14:6 | Run Step: artifact [pr_number] | .github/workflows/untrusted_checkout1.yml:15:20:15:58 | steps.artifact.outputs.pr_number | provenance |  |
 | .github/workflows/untrusted_checkout1.yml:12:14:13:63 | echo "::set-output name=pr_number::$(<artifact.txt)"\n | .github/workflows/untrusted_checkout1.yml:11:9:14:6 | Run Step: artifact [pr_number] | provenance |  |
 nodes
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | semmle.label | input body |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref |
 | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
 | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
 | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
@@ -261,15 +280,6 @@ nodes
 | .github/actions/action7/action.yml:214:41:214:69 | inputs.github_username | semmle.label | inputs.github_username |
 | .github/actions/action7/action.yml:215:41:215:66 | inputs.github_email | semmle.label | inputs.github_email |
 | .github/actions/action7/action.yml:217:25:217:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title |
-| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | semmle.label | input body |
-| .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body |
-| .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref |
 | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | semmle.label | Uses Step: remove_quotations [replaced] |
 | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | semmle.label | github.event.issue.title |
 | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | semmle.label | env.ISSUE_TITLE |
@@ -342,16 +352,6 @@ nodes
 | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | semmle.label | github.event.discussion.title |
 | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | semmle.label | github.event.discussion.body |
 | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | semmle.label | github.event.comment.body |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log |
 | .github/workflows/gollum.yml:7:19:7:52 | github.event.pages[1].title | semmle.label | github.event.pages[1].title |
 | .github/workflows/gollum.yml:8:19:8:53 | github.event.pages[11].title | semmle.label | github.event.pages[11].title |
 | .github/workflows/gollum.yml:9:19:9:56 | github.event.pages[0].page_name | semmle.label | github.event.pages[0].page_name |
@@ -701,15 +701,20 @@ nodes
 | .github/workflows/workflow_run_branches5.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
 subpaths
 | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] |
-| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] |
+| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] |
 #select
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | ${{ steps.git-commit.outputs.file-list }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | ${{ inputs.title }} | .github/workflows/composite-action-caller-4.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | ${{ inputs.taint }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | ${{ env.log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | ${{ env.prev_log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | ${{ inputs.body }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target |
 | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | .github/workflows/composite-action-caller-1.yml:3:3:3:21 | pull_request_target | pull_request_target |
 | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action5/action.yml:19:19:19:48 | github.event.issue.body | ${{ github.event.issue.body }} | .github/workflows/composite-action-caller-3.yml:3:3:3:15 | issue_comment | issue_comment |
 | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | ${{ inputs.taint }} | .github/workflows/composite-action-caller-3.yml:3:3:3:15 | issue_comment | issue_comment |
 | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/action6/action.yml:216:25:216:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test28.yml:12:3:12:21 | pull_request_target | pull_request_target |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | ${{ inputs.title }} | .github/workflows/composite-action-caller-4.yml:4:3:4:21 | pull_request_target | pull_request_target |
-| .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | ${{ inputs.body }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target |
-| .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | Potential code injection in $@, which may be controlled by an external user ($@). | .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | ${{ github.head_ref \|\| github.ref }} | .github/workflows/test29.yml:12:3:12:21 | pull_request_target | pull_request_target |
 | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | ${{steps.remove_quotations.outputs.replaced}} | .github/workflows/argus_case_study.yml:4:3:4:8 | issues | issues |
 | .github/workflows/artifactpoisoning1.yml:27:67:27:92 | steps.pr.outputs.id | .github/workflows/artifactpoisoning1.yml:14:9:20:6 | Uses Step | .github/workflows/artifactpoisoning1.yml:27:67:27:92 | steps.pr.outputs.id | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning1.yml:27:67:27:92 | steps.pr.outputs.id | ${{ steps.pr.outputs.id }} | .github/workflows/artifactpoisoning1.yml:4:3:4:14 | workflow_run | workflow_run |
 | .github/workflows/artifactpoisoning2.yml:22:17:22:42 | steps.pr.outputs.id | .github/workflows/artifactpoisoning2.yml:13:9:19:6 | Uses Step: pr | .github/workflows/artifactpoisoning2.yml:22:17:22:42 | steps.pr.outputs.id | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning2.yml:22:17:22:42 | steps.pr.outputs.id | ${{ steps.pr.outputs.id }} | .github/workflows/artifactpoisoning2.yml:4:3:4:14 | workflow_run | workflow_run |
@@ -738,11 +743,6 @@ subpaths
 | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | ${{ github.event.discussion.title }} | .github/workflows/discussion_comment.yml:1:5:1:22 | discussion_comment | discussion_comment |
 | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | ${{ github.event.discussion.body }} | .github/workflows/discussion_comment.yml:1:5:1:22 | discussion_comment | discussion_comment |
 | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/discussion_comment.yml:1:5:1:22 | discussion_comment | discussion_comment |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | ${{ steps.git-commit.outputs.file-list }} | .github/workflows/test22.yml:2:3:2:14 | workflow_run | workflow_run |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | ${{ inputs.taint }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | ${{ env.log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | ${{ env.prev_log }} | .github/workflows/reusable-workflow-caller-3.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/image_link_generator.yml:37:85:37:125 | steps.trim-url.outputs.trimmed_url | .github/workflows/image_link_generator.yml:18:18:18:49 | github.event.comment.body | .github/workflows/image_link_generator.yml:37:85:37:125 | steps.trim-url.outputs.trimmed_url | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/image_link_generator.yml:37:85:37:125 | steps.trim-url.outputs.trimmed_url | ${{ steps.trim-url.outputs.trimmed_url }} | .github/workflows/image_link_generator.yml:4:3:4:15 | issue_comment | issue_comment |
 | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/issues.yaml:13:19:13:49 | github.event.issue.title | ${{ github.event.issue.title }} | .github/workflows/issues.yaml:1:5:1:10 | issues | issues |
 | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/issues.yaml:14:19:14:48 | github.event.issue.body | ${{ github.event.issue.body }} | .github/workflows/issues.yaml:1:5:1:10 | issues | issues |
diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected
index 231d41bc2518..1972c75fbae3 100644
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected
@@ -1,4 +1,15 @@
 edges
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance |  |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance |  |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | provenance |  |
 | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | provenance |  |
 | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:34:19:34:37 | inputs.taint | provenance |  |
 | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result2] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result2] | provenance |  |
@@ -8,12 +19,6 @@ edges
 | .github/actions/action5/action.yml:23:15:23:33 | inputs.taint | .github/actions/action5/action.yml:20:7:26:4 | Run Step: step [result] | provenance |  |
 | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | .github/actions/action5/action.yml:14:13:14:46 | steps.step2.outputs.result2 | provenance |  |
 | .github/actions/action5/action.yml:28:16:28:45 | github.event.issue.body | .github/actions/action5/action.yml:26:7:31:4 | Run Step: step2 [result2] | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | provenance |  |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | provenance |  |
-| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | provenance |  |
 | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | .github/workflows/argus_case_study.yml:27:33:27:77 | steps.remove_quotations.outputs.replaced | provenance |  |
 | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | provenance |  |
 | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | provenance |  |
@@ -49,7 +54,7 @@ edges
 | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | provenance |  |
 | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] | provenance |  |
 | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | .github/workflows/composite-action-caller-4.yml:17:21:17:53 | steps.clone.outputs.result | provenance |  |
-| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance |  |
+| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | provenance |  |
 | .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] | provenance |  |
 | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | provenance |  |
 | .github/workflows/cross3.yml:27:7:37:4 | Uses Step: remove_quotations [replaced] | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | provenance |  |
@@ -57,11 +62,6 @@ edges
 | .github/workflows/cross3.yml:39:31:39:75 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:42:86:42:113 | env.ISSUE_BODY_PARSED | provenance |  |
 | .github/workflows/cross3.yml:57:29:57:73 | steps.remove_quotations.outputs.replaced | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | provenance |  |
 | .github/workflows/cross3.yml:68:11:68:38 | env.ISSUE_BODY_PARSED | .github/workflows/cross3.yml:53:89:53:107 | env.pr_message | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | provenance |  |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | provenance |  |
 | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | .github/workflows/image_link_generator.yml:25:25:25:68 | steps.extract-url.outputs.initial_url | provenance |  |
 | .github/workflows/image_link_generator.yml:18:18:18:49 | github.event.comment.body | .github/workflows/image_link_generator.yml:15:9:22:6 | Run Step: extract-url [initial_url] | provenance |  |
 | .github/workflows/image_link_generator.yml:22:9:28:6 | Run Step: curl [redirected_url] | .github/workflows/image_link_generator.yml:31:28:31:67 | steps.curl.outputs.redirected_url | provenance |  |
@@ -99,7 +99,7 @@ edges
 | .github/workflows/reusable-workflow-2.yml:45:24:45:61 | github.event.changes.title.from | .github/workflows/reusable-workflow-2.yml:66:34:66:52 | env.prev_log | provenance |  |
 | .github/workflows/reusable-workflow-caller-1.yml:11:15:11:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | provenance |  |
 | .github/workflows/reusable-workflow-caller-2.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/reusable-workflow-2.yml:6:7:6:11 | input taint | provenance |  |
-| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance |  |
+| .github/workflows/reusable-workflow-caller-3.yml:10:15:10:52 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | provenance |  |
 | .github/workflows/schedule_remote_code_injection.yml:12:9:18:6 | Uses Step: issues | .github/workflows/schedule_remote_code_injection.yml:19:21:19:52 | steps.issues.outputs.data | provenance |  |
 | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | .github/workflows/self_needs.yml:20:15:20:51 | needs.test1.outputs.job_output | provenance |  |
 | .github/workflows/self_needs.yml:11:20:11:52 | steps.source.outputs.value | .github/workflows/self_needs.yml:11:7:12:4 | Job outputs node [job_output] | provenance |  |
@@ -223,7 +223,7 @@ edges
 | .github/workflows/test27.yml:35:9:41:6 | Uses Step | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(<ERSION)" \| tee -a $GITHUB_OUTPUT\n | provenance | Config |
 | .github/workflows/test27.yml:41:9:46:2 | Run Step: get-version [chart_version] | .github/workflows/test27.yml:20:23:20:68 | steps.get-version.outputs.chart_version | provenance |  |
 | .github/workflows/test27.yml:43:14:44:66 | echo "chart_version=$(<ERSION)" \| tee -a $GITHUB_OUTPUT\n | .github/workflows/test27.yml:41:9:46:2 | Run Step: get-version [chart_version] | provenance |  |
-| .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | provenance |  |
+| .github/workflows/test29.yml:35:18:35:54 | github.event.pull_request.body | 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | provenance |  |
 | .github/workflows/test.yml:11:7:13:4 | Job outputs node [job_output] | .github/workflows/test.yml:52:20:52:56 | needs.job1.outputs['job_output'] | provenance |  |
 | .github/workflows/test.yml:11:20:11:50 | steps.step5.outputs.MSG5 | .github/workflows/test.yml:11:7:13:4 | Job outputs node [job_output] | provenance |  |
 | .github/workflows/test.yml:17:9:23:6 | Uses Step: step0 [value] | .github/workflows/test.yml:25:18:25:48 | steps.step0.outputs.value | provenance |  |
@@ -242,6 +242,25 @@ edges
 | .github/workflows/untrusted_checkout1.yml:11:9:14:6 | Run Step: artifact [pr_number] | .github/workflows/untrusted_checkout1.yml:15:20:15:58 | steps.artifact.outputs.pr_number | provenance |  |
 | .github/workflows/untrusted_checkout1.yml:12:14:13:63 | echo "::set-output name=pr_number::$(<artifact.txt)"\n | .github/workflows/untrusted_checkout1.yml:11:9:14:6 | Run Step: artifact [pr_number] | provenance |  |
 nodes
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3u61h4t2rfnaf/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:66:3:66:6 | input body | semmle.label | input body |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body |
+| 9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref |
 | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
 | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
 | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
@@ -261,15 +280,6 @@ nodes
 | .github/actions/action7/action.yml:214:41:214:69 | inputs.github_username | semmle.label | inputs.github_username |
 | .github/actions/action7/action.yml:215:41:215:66 | inputs.github_email | semmle.label | inputs.github_email |
 | .github/actions/action7/action.yml:217:25:217:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | semmle.label | input title |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | semmle.label | output Job outputs node [result] |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:16:13:16:45 | steps.out.outputs.replaced | semmle.label | steps.out.outputs.replaced |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:22:19:22:37 | inputs.title | semmle.label | inputs.title |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:23:7:30:4 | Uses Step: out [replaced] | semmle.label | Uses Step: out [replaced] |
-| .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:27:19:27:37 | inputs.title | semmle.label | inputs.title |
-| .github/actions/external/ultralytics/actions/action.yaml:66:3:66:6 | input body | semmle.label | input body |
-| .github/actions/external/ultralytics/actions/action.yaml:96:16:96:33 | inputs.body | semmle.label | inputs.body |
-| .github/actions/external/ultralytics/actions/action.yaml:223:25:223:60 | github.head_ref \|\| github.ref | semmle.label | github.head_ref \|\| github.ref |
 | .github/workflows/argus_case_study.yml:15:9:24:6 | Uses Step: remove_quotations [replaced] | semmle.label | Uses Step: remove_quotations [replaced] |
 | .github/workflows/argus_case_study.yml:17:25:17:53 | github.event.issue.title | semmle.label | github.event.issue.title |
 | .github/workflows/argus_case_study.yml:22:20:22:39 | env.ISSUE_TITLE | semmle.label | env.ISSUE_TITLE |
@@ -342,16 +352,6 @@ nodes
 | .github/workflows/discussion_comment.yml:7:19:7:54 | github.event.discussion.title | semmle.label | github.event.discussion.title |
 | .github/workflows/discussion_comment.yml:8:19:8:53 | github.event.discussion.body | semmle.label | github.event.discussion.body |
 | .github/workflows/discussion_comment.yml:9:19:9:50 | github.event.comment.body | semmle.label | github.event.comment.body |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:59:7:88:4 | Run Step: git-commit [file-list] | semmle.label | Run Step: git-commit [file-list] |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:62:12:84:75 | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n | semmle.label | set -x\n# Set initial placeholder name/mail and read it from the patch later\ngit config --global user.email 'foo@bar'\ngit config --global user.name 'Foo Bar'\n\ngit am version_increments.patch\n\n# Read the author's name+mail from the just applied patch and recommit it with both set as committer\nbotMail=$(git log -1 --pretty=format:'%ae')\nbotName=$(git log -1 --pretty=format:'%an')\ngit config --global user.email "${botMail}"\ngit config --global user.name "${botName}"\ngit commit --amend --no-edit\n\nfileList=$(git diff-tree --no-commit-id --name-only HEAD -r)\necho "file-list<<EOF" >> $GITHUB_OUTPUT\necho "$fileList" >> $GITHUB_OUTPUT\necho "EOF" >> $GITHUB_OUTPUT\n\ngit push \\\n  "https://oauth2:${BOT_PA_TOKEN}@github.com/${{ github.event.workflow_run.head_repository.full_name }}.git" \\\n  'HEAD:refs/heads/${{ github.event.workflow_run.head_branch }}'\n |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:84:28:84:71 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/publishResults.yml:94:30:94:70 | steps.git-commit.outputs.file-list | semmle.label | steps.git-commit.outputs.file-list |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:6:7:6:11 | input taint | semmle.label | input taint |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:45:24:45:61 | github.event.changes.title.from | semmle.label | github.event.changes.title.from |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:53:26:53:39 | env.log | semmle.label | env.log |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable-workflow.yml:66:34:66:52 | env.prev_log | semmle.label | env.prev_log |
 | .github/workflows/gollum.yml:7:19:7:52 | github.event.pages[1].title | semmle.label | github.event.pages[1].title |
 | .github/workflows/gollum.yml:8:19:8:53 | github.event.pages[11].title | semmle.label | github.event.pages[11].title |
 | .github/workflows/gollum.yml:9:19:9:56 | github.event.pages[0].page_name | semmle.label | github.event.pages[0].page_name |
@@ -701,7 +701,7 @@ nodes
 | .github/workflows/workflow_run_branches5.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
 subpaths
 | .github/workflows/composite-action-caller-3.yml:12:19:12:50 | github.event.comment.body | .github/actions/action5/action.yml:4:3:4:7 | input taint | .github/actions/action5/action.yml:9:3:14:46 | output Job outputs node [result] | .github/workflows/composite-action-caller-3.yml:9:9:13:6 | Uses Step: foo [result] |
-| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | .github/actions/external/TestOrg/TestRepo/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] |
+| .github/workflows/composite-action-caller-4.yml:14:19:14:56 | github.event.pull_request.title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:4:3:4:7 | input title | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml:14:3:16:45 | output Job outputs node [result] | .github/workflows/composite-action-caller-4.yml:10:9:17:6 | Uses Step: clone [result] |
 #select
 | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} |
 | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action4/action.yml:7:19:7:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} |
diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml
rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested.yml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested.yml
rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml
rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml
rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml b/actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml
similarity index 100%
rename from actions/ql/test/query-tests/Security/CWE-829/.github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml
rename to actions/ql/test/query-tests/Security/CWE-829/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected
index 910d5742e572..b5f914e2baf9 100644
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected
@@ -1,4 +1,11 @@
 edges
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml:11:9:19:6 | Uses Step: checkAccess | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build_nested_branching.yml:19:9:25:2 | Run Step |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:14:9:19:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:19:9:25:6 | Run Step |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:19:9:25:6 | Run Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/formal.yml:25:9:70:20 | Run Step |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:26:9:29:7 | Run Step |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:25:17:25:36 | inputs.branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:23:9:26:6 | Uses Step |
 | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:11:7:12:18 | Run Step |
 | .github/actions/dangerous-git-checkout/action.yml:9:15:9:55 | github.event.pull_request.head.sha | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step |
 | .github/actions/dangerous-git-checkout/action.yml:11:7:12:18 | Run Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step |
@@ -100,13 +107,6 @@ edges
 | .github/workflows/dependabot3.yml:18:17:18:57 | github.event.pull_request.head.sha | .github/workflows/dependabot3.yml:15:9:20:6 | Uses Step |
 | .github/workflows/dependabot3.yml:20:9:25:6 | Uses Step | .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone |
 | .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone | .github/workflows/dependabot3.yml:48:9:52:57 | Run Step |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml:11:9:19:6 | Uses Step: checkAccess | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build_nested_branching.yml:19:9:25:2 | Run Step |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:14:9:19:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:19:9:25:6 | Run Step |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:19:9:25:6 | Run Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/formal.yml:25:9:70:20 | Run Step |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:26:9:29:7 | Run Step |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:25:17:25:36 | inputs.branch | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:23:9:26:6 | Uses Step |
 | .github/workflows/gitcheckout.yml:10:11:18:8 | Run Step | .github/workflows/gitcheckout.yml:18:11:21:8 | Uses Step |
 | .github/workflows/gitcheckout.yml:17:27:17:48 | github.head_ref | .github/workflows/gitcheckout.yml:10:11:18:8 | Run Step |
 | .github/workflows/gitcheckout.yml:18:11:21:8 | Uses Step | .github/workflows/gitcheckout.yml:21:11:23:22 | Run Step |
@@ -438,16 +438,16 @@ edges
 | .github/workflows/workflow_run_untrusted_checkout_3.yml:15:17:15:57 | github.event.workflow_run.head.sha | .github/workflows/workflow_run_untrusted_checkout_3.yml:13:9:16:6 | Uses Step |
 | .github/workflows/workflow_run_untrusted_checkout_3.yml:18:17:18:31 | env.HEAD | .github/workflows/workflow_run_untrusted_checkout_3.yml:16:9:18:31 | Uses Step |
 #select
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | inputs.COMMIT_SHA | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:2:3:2:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | inputs.COMMIT_SHA | .github/workflows/untrusted_checkout_permission_check_reusable_branching_nested.yml:2:3:2:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:11:9:14:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | inputs.COMMIT_SHA | .github/workflows/untrusted_checkout_permission_check_reusable_no_needs.yml:2:3:2:21 | pull_request_target | pull_request_target |
+| 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:25:17:25:36 | inputs.branch | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:26:9:29:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | 9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/workflows/reusable.yml:25:17:25:36 | inputs.branch | inputs.branch | .github/workflows/reusable_caller1.yaml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:9:15:9:55 | github.event.pull_request.head.sha | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/actions/dangerous-git-checkout/action.yml:9:15:9:55 | github.event.pull_request.head.sha | github.event.pull_request.head.sha | .github/workflows/untrusted_checkout3.yml:4:3:4:14 | workflow_run | workflow_run |
 | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:24:17:24:57 | github.event.pull_request.head.ref | .github/workflows/auto_ci.yml:32:9:37:6 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:24:17:24:57 | github.event.pull_request.head.ref | github.event.pull_request.head.ref | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target |
 | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:24:17:24:57 | github.event.pull_request.head.ref | .github/workflows/auto_ci.yml:48:9:52:2 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:24:17:24:57 | github.event.pull_request.head.ref | github.event.pull_request.head.ref | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target |
 | .github/workflows/auto_ci.yml:67:9:74:6 | Uses Step | .github/workflows/auto_ci.yml:71:17:71:95 | github.event.pull_request.head.ref \|\| github.event.pull_request.base.ref | .github/workflows/auto_ci.yml:79:9:84:6 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:71:17:71:95 | github.event.pull_request.head.ref \|\| github.event.pull_request.base.ref | github.event.pull_request.head.ref \|\| github.event.pull_request.base.ref | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target |
 | .github/workflows/auto_ci.yml:67:9:74:6 | Uses Step | .github/workflows/auto_ci.yml:71:17:71:95 | github.event.pull_request.head.ref \|\| github.event.pull_request.base.ref | .github/workflows/auto_ci.yml:84:9:93:6 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:71:17:71:95 | github.event.pull_request.head.ref \|\| github.event.pull_request.base.ref | github.event.pull_request.head.ref \|\| github.event.pull_request.base.ref | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target |
 | .github/workflows/dependabot3.yml:15:9:20:6 | Uses Step | .github/workflows/dependabot3.yml:18:17:18:57 | github.event.pull_request.head.sha | .github/workflows/dependabot3.yml:25:9:48:6 | Run Step: set-milestone | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/dependabot3.yml:18:17:18:57 | github.event.pull_request.head.sha | github.event.pull_request.head.sha | .github/workflows/dependabot3.yml:3:5:3:23 | pull_request_target | pull_request_target |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | inputs.COMMIT_SHA | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:2:3:2:21 | pull_request_target | pull_request_target |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | inputs.COMMIT_SHA | .github/workflows/untrusted_checkout_permission_check_reusable_branching_nested.yml:2:3:2:21 | pull_request_target | pull_request_target |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:11:9:14:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:14:9:17:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/build.yml:13:17:13:40 | inputs.COMMIT_SHA | inputs.COMMIT_SHA | .github/workflows/untrusted_checkout_permission_check_reusable_no_needs.yml:2:3:2:21 | pull_request_target | pull_request_target |
-| .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:23:9:26:6 | Uses Step | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:25:17:25:36 | inputs.branch | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:26:9:29:7 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/external/TestOrg/TestRepo/.github/workflows/reusable.yml:25:17:25:36 | inputs.branch | inputs.branch | .github/workflows/reusable_caller1.yaml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/gitcheckout.yml:10:11:18:8 | Run Step | .github/workflows/gitcheckout.yml:17:27:17:48 | github.head_ref | .github/workflows/gitcheckout.yml:21:11:23:22 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/gitcheckout.yml:17:27:17:48 | github.head_ref | github.head_ref | .github/workflows/gitcheckout.yml:2:3:2:21 | pull_request_target | pull_request_target |
 | .github/workflows/label_trusted_checkout2.yml:12:7:16:4 | Uses Step | .github/workflows/label_trusted_checkout2.yml:14:15:14:55 | github.event.pull_request.head.sha | .github/workflows/label_trusted_checkout2.yml:17:7:21:4 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/label_trusted_checkout2.yml:14:15:14:55 | github.event.pull_request.head.sha | github.event.pull_request.head.sha | .github/workflows/label_trusted_checkout2.yml:2:3:2:21 | pull_request_target | pull_request_target |
 | .github/workflows/level0.yml:99:9:103:6 | Uses Step | .github/workflows/level0.yml:102:17:102:57 | github.event.pull_request.head.sha | .github/workflows/level0.yml:107:9:112:2 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/level0.yml:102:17:102:57 | github.event.pull_request.head.sha | github.event.pull_request.head.sha | .github/workflows/level0.yml:5:3:5:15 | issue_comment | issue_comment |
diff --git a/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst b/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst
index 0b78b37359f4..55fda4b2dfcc 100644
--- a/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst
+++ b/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst
@@ -32,6 +32,8 @@ Customizing Actions-specific analysis:
 
 - ``argumentInjectionSinksDataModel(regexp, command_group, argument_group)``
 - ``contextTriggerDataModel(trigger, context_prefix)``
+- ``externalCompositeActionDataModel(owner, repo, action_path, requested_ref, resolved_commit_sha, local_path)``
+- ``externalReusableWorkflowDataModel(owner, repo, workflow_path, requested_ref, resolved_commit_sha, local_path)``
 - ``externallyTriggerableEventsDataModel(event)``
 - ``immutableActionsDataModel(action)``
 - ``poisonableActionsDataModel(action)``