Write a clickable source link in untrusted checkout message

Author: JarLob

actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll

@@ -425,7 +425,7 @@ AstNode getCheckoutReference(PRHeadCheckoutStep checkout) {
 
 /** Gets a display label for the expression that controls the untrusted checkout. */
 string getCheckoutReferenceText(AstNode reference) {
-  result = reference.(Expression).getExpression()
+  result = reference.(Expression).toString()
   or
   not reference instanceof Expression and result = "the checkout command"
 }

actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql

@@ -28,8 +28,12 @@ query predicate edges(AstNode predecessor, AstNode successor) {
   checkoutReferenceEdge(predecessor, successor)
 }
 
-from PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event
+from
+  PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event, AstNode checkoutReference,
+  string checkoutReferenceText
 where
+  checkoutReference = getCheckoutReference(checkout) and
+  checkoutReferenceText = getCheckoutReferenceText(checkoutReference) and
   // the checkout is followed by a known poisonable step
   checkout.getAFollowingStep() = poisonable and
   (
@@ -59,6 +63,6 @@ where
   event.getName() = checkoutTriggers() and
   not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout")) and
   not exists(ControlCheck check | check.protects(poisonable, event, "untrusted-checkout"))
-select checkout, getCheckoutReference(checkout), poisonable,
-  "Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@).",
-  event, event.getName()
+select checkout, checkoutReference, poisonable,
+  "Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@).",
+  checkoutReference, checkoutReferenceText, event, event.getName()

actions/ql/src/change-notes/2026-07-28-checkout-provenance.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* The `actions/cache-poisoning/poisonable-step` and `actions/untrusted-checkout/critical` queries now start paths at the expressions that control untrusted checkouts and link their alert messages to those expressions.