Actions: ensure CFG callable scopes are unique

Prefer the composite-action interpretation when a YAML document is recognized as both a workflow and a composite action, ensuring each CFG node has a unique enclosing callable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: owen-mc

actions/ql/lib/codeql/actions/controlflow/internal/Cfg.qll

@@ -93,14 +93,26 @@ module CfgImpl {
     AstNode getChild(AstNode node, int index) { result = getCfgChild(node, index) }
 
     class Callable extends AstNode {
-      Callable() { this instanceof Workflow or this instanceof CompositeAction }
+      Callable() {
+        this instanceof CompositeAction
+        or
+        this instanceof Workflow and
+        not exists(CompositeAction action | action.getLocation() = this.getLocation())
+      }
     }
 
     AstNode callableGetBody(Callable callable) { result = callable }
 
+    /**
+     * Gets the unique callable containing `node`.
+     *
+     * An Actions AST node may have multiple parent paths, but they converge on
+     * the same root.
+     */
     Callable getEnclosingCallable(AstNode node) {
-      result = node.(Callable)
+      result = node
       or
+      not node instanceof Callable and
       result = getEnclosingCallable(node.getParentNode())
     }
 

actions/ql/test/library-tests/cfg-callable/action.yml

@@ -0,0 +1,12 @@
+name: Ambiguous root
+
+runs:
+  using: composite
+  steps:
+    - run: echo "${{ github.actor }}"
+
+jobs:
+  unexpected:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "This must not make action.yml a workflow"

actions/ql/test/library-tests/cfg-callable/test.expected

@@ -0,0 +1,5 @@
+roots
+| 1 | 1 |
+cfgScopes
+| action.yml:1:1:12:61 | name: Ambiguous root | composite action |
+cfgConsistency

actions/ql/test/library-tests/cfg-callable/test.ql

@@ -0,0 +1,23 @@
+import codeql.actions.Ast
+import codeql.actions.Cfg as Cfg
+
+query predicate roots(int workflows, int compositeActions) {
+  workflows =
+    strictcount(Workflow workflow | workflow.getLocation().getFile().getBaseName() = "action.yml") and
+  compositeActions =
+    strictcount(CompositeAction action | action.getLocation().getFile().getBaseName() = "action.yml")
+}
+
+query predicate cfgScopes(Cfg::CfgScope scope, string kind) {
+  scope.getLocation().getFile().getBaseName() = "action.yml" and
+  (
+    scope instanceof Cfg::WorkflowScope and kind = "workflow"
+    or
+    scope instanceof Cfg::CompositeActionScope and kind = "composite action"
+  )
+}
+
+query predicate cfgConsistency(string query, int results) {
+  Cfg::Consistency::consistencyOverview(query, results) and
+  results != 0
+}