Actions: Add new query actions/code-injection/low for code injection with step outputs

[owen-mc]

This has low precision but can catch serious issues. However, because of its low precision, it won't be included in any of our query suites. I'm not sure what to do about that.

The allowlist of actions whose outputs are not user-controlled was generated by copilot, using results from running this query on many repos using MRVA. I do not have the expertise to be sure that it is correct, so please check this. I am also interested in any other actions to add to the allowlist. Possibly we could allow users to add safe actions using data extensions, if there is demand.

[Copilot]

Pull request overview

This PR adds a new low-precision code injection query for GitHub Actions that detects potential vulnerabilities when step outputs flow to code injection sinks. Additionally, it refactors the StepsExpression class to StepOutputExpression for better naming clarity.

• Introduces actions/code-injection/low query to detect code injection via step outputs with an allowlist of known-safe actions
• Renames StepsExpression to StepOutputExpression throughout the codebase with proper deprecation
• Adds comprehensive documentation and examples for the new query

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
actions/ql/src/Security/CWE-094/CodeInjectionLow.ql	New query implementation for low-precision code injection detection from step outputs
actions/ql/src/Security/CWE-094/CodeInjectionLow.md	Documentation explaining the vulnerability, recommendations, and usage examples
actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll	Adds new data flow configuration, allowlist of safe actions, and lowSeverityCodeInjection predicate
actions/ql/lib/codeql/actions/Ast.qll	Deprecates StepsExpression and introduces StepOutputExpression as replacement
actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll	Updates references from StepsExpression to StepOutputExpression
actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll	Updates references from StepsExpression to StepOutputExpression
actions/ql/lib/codeql/actions/dataflow/TaintSteps.qll	Updates references from StepsExpression to StepOutputExpression
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionLow.qlref	Test reference file for the new query
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionLow.expected	Expected test results for the new query
actions/ql/src/change-notes/2025-12-05-add-code-injection-low-query.md	Change note documenting the new query
actions/ql/lib/change-notes/2025-12-05-rename-steps-expression.md	Change note documenting the deprecation of StepsExpression

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[owen-mc]

@adityasharad Are you able to review this? CI was failing but rebasing has resolved it.