Revert "Actions lockfiles: require repository identity"

This reverts commit 0106f4e.

Author: nodeselector

actions/ql/lib/change-notes/2026-09-01-actions-lock-yaml.md

@@ -2,5 +2,4 @@
 category: feature
 ---
 * GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
-  provides access to their YAML abstract syntax trees and workflow pins with positive owner and
-  repository IDs and a full commit digest.
+  provides access to their YAML abstract syntax trees and structurally valid workflow pins.

actions/ql/lib/codeql/actions/Lock.qll

@@ -9,9 +9,8 @@ class ActionsLock extends YamlDocument {
   ActionsLock() { this.getFile().getBaseName() = "actions.lock" }
 
   /**
-   * Holds if the lockfile records `nwo` at `ref` for `workflowPath` with positive owner and
-   * repository IDs and a full commit digest. Repository pins also cover sub-actions such as
-   * `actions/cache/save`.
+   * Holds if the lockfile records `nwo` at `ref` for `workflowPath` with a full commit digest.
+   * Repository pins also cover sub-actions such as `actions/cache/save`.
    */
   bindingset[nwo]
   predicate pins(string workflowPath, string nwo, string ref) {
@@ -33,8 +32,6 @@ class ActionsLock extends YamlDocument {
       ) and
       root.lookup("dependencies").(YamlMapping).lookup(pin) = dependency and
       dependency.lookup("ref").(YamlScalar).getValue() = ref and
-      dependency.lookup("owner_id").(YamlScalar).getValue().toInt() > 0 and
-      dependency.lookup("repo_id").(YamlScalar).getValue().toInt() > 0 and
       dependency
           .lookup("commit")
           .(YamlScalar)

actions/ql/src/change-notes/2026-07-09-unpinned-tag-lockfile-aware.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The `actions/unpinned-tag` query no longer reports action references pinned by a `.github/workflows/actions.lock` entry with positive owner and repository IDs and a full commit digest for the enclosing workflow.
+* The `actions/unpinned-tag` query no longer reports action references pinned by a structurally valid `.github/workflows/actions.lock` entry for the enclosing workflow.

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/actions.lock

@@ -5,8 +5,6 @@ workflows:
     - mismatched/action@v1
     - malformed/action@v1
     - missing/action@v1
-    - missing-owner/action@v1
-    - zero-repo/action@v1
   .github/workflows/other.yml:
     - other-workflow/action@v1
 dependencies:
@@ -30,12 +28,3 @@ dependencies:
     commit: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
     owner_id: 5
     repo_id: 6
-  missing-owner/action@v1:
-    ref: v1
-    commit: sha1-3333333333333333333333333333333333333333
-    repo_id: 7
-  zero-repo/action@v1:
-    ref: v1
-    commit: sha1-4444444444444444444444444444444444444444
-    owner_id: 8
-    repo_id: 0

actions/ql/test/query-tests/Security/CWE-829-Lockfile/.github/workflows/rust-ci.yml

@@ -12,7 +12,5 @@ jobs:
     - uses: mismatched/action@v1 # $ Alert
     - uses: malformed/action@v1 # $ Alert
     - uses: missing/action@v1 # $ Alert
-    - uses: missing-owner/action@v1 # $ Alert
-    - uses: zero-repo/action@v1 # $ Alert
   reusable:
     uses: dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 # $ Alert

actions/ql/test/query-tests/Security/CWE-829-Lockfile/UnpinnedActionsTag.expected

@@ -2,7 +2,5 @@
 | .github/workflows/rust-ci.yml:11:13:11:36 | other-workflow/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'other-workflow/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:11:7:12:4 | Uses Step | Uses Step |
 | .github/workflows/rust-ci.yml:12:13:12:32 | mismatched/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'mismatched/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:12:7:13:4 | Uses Step | Uses Step |
 | .github/workflows/rust-ci.yml:13:13:13:31 | malformed/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'malformed/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:13:7:14:4 | Uses Step | Uses Step |
-| .github/workflows/rust-ci.yml:14:13:14:29 | missing/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:14:7:15:4 | Uses Step | Uses Step |
-| .github/workflows/rust-ci.yml:15:13:15:35 | missing-owner/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing-owner/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:15:7:16:4 | Uses Step | Uses Step |
-| .github/workflows/rust-ci.yml:16:13:16:31 | zero-repo/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'zero-repo/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:16:7:17:2 | Uses Step | Uses Step |
-| .github/workflows/rust-ci.yml:18:11:18:66 | dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 | Job $@ in 'rust-ci.yml' uses reusable workflow 'dtolnay/rust-toolchain/.github/workflows/reusable.yml' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:18:5:18:77 | Job: reusable | Job: reusable |
+| .github/workflows/rust-ci.yml:14:13:14:29 | missing/action@v1 | Unpinned 3rd party Action 'rust-ci.yml' step $@ uses 'missing/action' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:14:7:15:2 | Uses Step | Uses Step |
+| .github/workflows/rust-ci.yml:16:11:16:66 | dtolnay/rust-toolchain/.github/workflows/reusable.yml@v1 | Job $@ in 'rust-ci.yml' uses reusable workflow 'dtolnay/rust-toolchain/.github/workflows/reusable.yml' with ref 'v1', not a pinned commit hash | .github/workflows/rust-ci.yml:16:5:16:77 | Job: reusable | Job: reusable |