Support self-repository external references

Resolve $/ paths in downloaded reusable workflows and composite actions against their modeled repository, and cover both forms while retaining ./ compatibility.

Author: JarLob

actions/ql/lib/codeql/actions/ast/internal/Ast.qll

@@ -1441,7 +1441,11 @@ class UsesStepImpl extends StepImpl, UsesImpl {
     else result = u.getValue()
   }
 
-  private predicate isLocalCall() { u.getValue().matches(["./%", ".github/%"]) }
+  private predicate isWorkspaceLocalCall() { u.getValue().matches(["./%", ".github/%"]) }
+
+  private predicate isSelfCall() { u.getValue().matches("$/%") }
+
+  private predicate isLocalCall() { this.isWorkspaceLocalCall() or this.isSelfCall() }
 
   private predicate hasModeledExternalCallee() {
     exists(
@@ -1473,15 +1477,36 @@ class UsesStepImpl extends StepImpl, UsesImpl {
     )
   }
 
+  private string getSelfCallableName() {
+    exists(
+      CompositeActionImpl action, string owner, string repo, string action_path,
+      string requested_ref, string resolved_commit_sha, string local_path
+    |
+      action = this.getEnclosingCompositeAction() and
+      action
+          .getAnExternalCompositeActionModel(owner, repo, action_path, requested_ref,
+            resolved_commit_sha, local_path) and
+      result =
+        externalCompositeActionName(owner, repo, this.getCallee().suffix(2)) + "@" +
+          requested_ref.trim()
+    )
+    or
+    not this.hasExternalEnclosingCompositeAction() and
+    result = this.getCallee().suffix(2)
+  }
+
   override string getCallableName() {
-    this.isLocalCall() and
+    this.isWorkspaceLocalCall() and
     (
       this.hasModeledExternalEnclosingCompositeAction()
       or
       not this.hasExternalEnclosingCompositeAction()
     ) and
     result = this.getCallee()
     or
+    this.isSelfCall() and
+    result = this.getSelfCallableName()
+    or
     not this.isLocalCall() and
     this.hasModeledExternalCallee() and
     result = this.getCallee() + "@" + this.getVersion()
@@ -1501,28 +1526,27 @@ class UsesStepImpl extends StepImpl, UsesImpl {
  * Gets a regular expression that parses an `owner/repo@version` reference within a `uses` field in an Actions job step.
  * local repo: octo-org/this-repo/.github/workflows/workflow-1.yml@172239021f7ba04fe7327647b213799853a9eb89
  * local repo: ./.github/workflows/workflow-2.yml
+ * local repo: $/.github/workflows/workflow-2.yml
  * remote repo: octo-org/another-repo/.github/workflows/workflow.yml@v1
  */
 private string repoUsesParser() { result = "([^/]+)/([^/]+)/([^@]+)@(.+)" }
 
-private string pathUsesParser() { result = "\\./(.+)" }
-
 class ExternalJobImpl extends JobImpl, UsesImpl {
   YamlScalar u;
 
   ExternalJobImpl() { n.lookup("uses") = u }
 
   override string getCallee() {
-    if u.getValue().matches("./%")
-    then result = u.getValue().regexpCapture(pathUsesParser(), 1)
+    if u.getValue().matches(["./%", "$/%"])
+    then result = u.getValue().suffix(2)
     else
       result =
         u.getValue().regexpCapture(repoUsesParser(), 1) + "/" +
           u.getValue().regexpCapture(repoUsesParser(), 2) + "/" +
           u.getValue().regexpCapture(repoUsesParser(), 3)
   }
 
-  private predicate isLocalCall() { u.getValue().matches("./%") }
+  private predicate isLocalCall() { u.getValue().matches(["./%", "$/%"]) }
 
   private predicate hasExternalEnclosingWorkflow() {
     exists(ReusableWorkflowImpl enclosing_workflow |

actions/ql/test/external-reusable-workflows.model.yml

@@ -20,5 +20,6 @@ extensions:
     data:
       - ["TestOrg", "Actions", "remote", "v1", "dddddddddddddddddddddddddddddddddddddddd", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml"]
       - ["TestOrg", "Actions", "remote", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml"]
+      - ["TestOrg", "Actions", ".github/actions/leaf", "v2", "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml"]
       - ["TestOrg", "TestRepo", ".github/actions/clone-repo", "main", "1111111111111111111111111111111111111111", "9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-07cp61dt7qne3/.github/actions/clone-repo/action.yaml"]
       - ["ultralytics", "actions", "", "main", "2222222222222222222222222222222222222222", "9466014afba34ef28239871ceabf4132/ultralytics/actions/ref-07cp61dt7qne3/action.yaml"]

actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml

@@ -0,0 +1,7 @@
+name: External leaf action at v2
+description: Completes a self-repository action chain
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: echo complete

actions/ql/test/library-tests/external-composite-actions/9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml

@@ -1,6 +1,6 @@
 name: External action at v2
-description: Calls back into the analyzed repository
+description: Calls an action in the same external repository
 runs:
   using: composite
   steps:
-    - uses: ./.github/actions/leaf
+    - uses: $/.github/actions/leaf

actions/ql/test/library-tests/external-composite-actions/external_composite_actions.expected

@@ -1,5 +1,5 @@
 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf |  | .github/actions/leaf/action.yml |
-| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml:6:7:6:35 | Uses Step | ./.github/actions/leaf |  | .github/actions/leaf/action.yml |
+| 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml:6:7:6:35 | Uses Step | $/.github/actions/leaf |  | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/.github/actions/leaf/action.yml |
 | .github/actions/root-v1/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v1 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-0wu7t20oora8i/remote/action.yml |
 | .github/actions/root-v2/action.yml:6:7:6:38 | Uses Step | TestOrg/Actions/remote | v2 | 9466014afba34ef28239871ceabf4132/TestOrg/Actions/ref-3tf7yq1278i0t/remote/action.yml |
 | .github/workflows/caller.yml:10:9:11:6 | Uses Step | ./.github/actions/root-v1 |  | .github/actions/root-v1/action.yml |

actions/ql/test/library-tests/external-reusable-workflows/9466014afba34ef28239871ceabf4132/TestOrg/TestRepo/ref-3tf7yq1278i0t/.github/workflows/first.yml

@@ -5,4 +5,4 @@ on:
 
 jobs:
   second:
-    uses: ./.github/workflows/second.yml
+    uses: $/.github/workflows/second.yml