actions: stop unpinned-tag flagging $/ self-references

A $/ reference (e.g. "uses: $/path/to/action") is a same-repo self-reference
that resolves to the commit the workflow is running at. It is inherently pinned,
exactly like a "./" local reference, so it must never be reported by
actions/unpinned-tag.

Adds an isSelfReference(nwo) guard to the query plus a test fixture covering the
bare "$/actions/foo" form and the "$/actions/foo@v1" form (the latter is
rejected by the $/ rule but writable by a user; the guard suppresses it either
way).

Part of github/actions-dispatch#755.

Author: nodeselector

actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

@@ -33,6 +33,12 @@ private predicate isPinnedContainer(string version) {
 bindingset[nwo]
 private predicate isContainerImage(string nwo) { nwo.regexpMatch("^docker://.+") }
 
+// A `$/` reference is a same-repo self-reference (e.g. `$/path/to/action`), resolved at the
+// commit the calling workflow is running. Like `./` local references, it is inherently pinned
+// and can never be an unpinned-tag finding, so we never flag it.
+bindingset[nwo]
+private predicate isSelfReference(string nwo) { nwo.matches("$/%") }
+
 private predicate getStepContainerName(UsesStep uses, string name) {
   exists(Workflow workflow |
     uses.getEnclosingWorkflow() = workflow and
@@ -55,6 +61,7 @@ where
   getStepContainerName(uses, name) and
   uses.getVersion() = version and
   not isTrustedOwner(nwo) and
+  not isSelfReference(nwo) and
   not (if isContainerImage(nwo) then isPinnedContainer(version) else isPinnedCommit(version)) and
   not isImmutableAction(uses, nwo)
 select uses.getCalleeNode(),

actions/ql/src/change-notes/2026-07-09-unpinned-tag-self-reference.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `actions/unpinned-tag` query no longer reports `$/` same-repo self-references (e.g. `uses: $/path/to/action`), which are inherently pinned to the running commit, just like `./` local references.

actions/ql/test/query-tests/Security/CWE-829/.github/workflows/self_ref_dollar.yml

@@ -0,0 +1,15 @@
+on:
+  pull_request
+
+jobs:
+  build:
+    name: Build and test
+    runs-on: ubuntu-latest
+    steps:
+    # `$/` is a same-repo self-reference resolved at the running commit. It is inherently
+    # pinned (like `./` local refs) and must never be reported as an unpinned tag.
+    - uses: $/actions/foo
+    # `$/…@ref` is rejected by the `$/` rule, but a user could still write it. It must also
+    # never be flagged; this case exercises the `not isSelfReference(nwo)` suppression, since
+    # without it `$/actions/foo@v1` would otherwise be reported as an unpinned tag.
+    - uses: $/actions/foo@v1