diff --git a/actions/ql/lib/change-notes/2026-08-19-association-if-check-event-validity.md b/actions/ql/lib/change-notes/2026-08-19-association-if-check-event-validity.md
new file mode 100644
index 000000000000..28ef240b2394
--- /dev/null
+++ b/actions/ql/lib/change-notes/2026-08-19-association-if-check-event-validity.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
diff --git a/actions/ql/lib/codeql/actions/security/ControlChecks.qll b/actions/ql/lib/codeql/actions/security/ControlChecks.qll
index 675c1d18852b..aea57fdc4b71 100644
--- a/actions/ql/lib/codeql/actions/security/ControlChecks.qll
+++ b/actions/ql/lib/codeql/actions/security/ControlChecks.qll
@@ -408,16 +408,37 @@ class WorkflowRunRepositoryIfCheck extends RepositoryCheck instanceof If {
   }
 }
 
+/**
+ * Gets a regular expression matching a condition on an author association field
+ * that is only populated for events whose payload contains the `context_prefix`
+ * context.
+ */
+private string eventPayloadAssociationFieldRegex(string context_prefix) {
+  context_prefix = "github.event.comment" and
+  result = "\\bgithub\\.event\\.comment\\.author_association\\b"
+  or
+  context_prefix = "github.event.issue" and
+  result = "\\bgithub\\.event\\.issue\\.author_association\\b"
+  or
+  context_prefix = "github.event.pull_request" and
+  result = "\\bgithub\\.event\\.pull_request\\.author_association\\b"
+}
+
 class AssociationIfCheck extends AssociationCheck instanceof If {
+  string context_prefix;
+
   AssociationIfCheck() {
     // eg: contains(fromJson('["MEMBER", "OWNER"]'), github.event.comment.author_association)
-    normalizeExpr(this.getCondition())
-        .splitAt("\n")
-        .regexpMatch([
-            ".*\\bgithub\\.event\\.comment\\.author_association\\b.*",
-            ".*\\bgithub\\.event\\.issue\\.author_association\\b.*",
-            ".*\\bgithub\\.event\\.pull_request\\.author_association\\b.*",
-          ])
+    exists(
+      normalizeExpr(this.getCondition())
+          .regexpFind(eventPayloadAssociationFieldRegex(context_prefix), _, _)
+    )
+  }
+
+  override predicate protectsCategoryAndEvent(string category, string event) {
+    AssociationCheck.super.protectsCategoryAndEvent(category, event) and
+    // association fields only restrict events whose payload populates them
+    contextTriggerDataModel(event, context_prefix)
   }
 }
 
diff --git a/actions/ql/test/query-tests/Security/CWE-094/.github/workflows/association_check_wrong_event.yml b/actions/ql/test/query-tests/Security/CWE-094/.github/workflows/association_check_wrong_event.yml
new file mode 100644
index 000000000000..b1cef25955dd
--- /dev/null
+++ b/actions/ql/test/query-tests/Security/CWE-094/.github/workflows/association_check_wrong_event.yml
@@ -0,0 +1,21 @@
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  # The `if:` condition compares an association field that is never populated
+  # for `issues` events, so it is always true and does not protect the
+  # injectable step.
+  vacuous-association-check:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.author_association != 'NONE'
+    steps:
+      - run: echo '${{ github.event.issue.title }}'
+
+  # `github.event.issue` is populated for `issues` events, so this check is
+  # effective and the injectable step is protected.
+  valid-association-check:
+    runs-on: ubuntu-latest
+    if: github.event.issue.author_association == 'MEMBER'
+    steps:
+      - run: echo '${{ github.event.issue.title }}'
diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected
index 14e50942d734..e32155dffe93 100644
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected
@@ -312,6 +312,8 @@ nodes
 | .github/workflows/artifactpoisoning8.yml:17:9:21:6 | Run Step: artifact [id] | semmle.label | Run Step: artifact [id] |
 | .github/workflows/artifactpoisoning8.yml:19:14:19:58 | echo "::set-output name=id::$(<artifact.txt)" | semmle.label | echo "::set-output name=id::$(<artifact.txt)" |
 | .github/workflows/artifactpoisoning8.yml:22:20:22:51 | steps.artifact.outputs.id | semmle.label | steps.artifact.outputs.id |
+| .github/workflows/association_check_wrong_event.yml:13:21:13:51 | github.event.issue.title | semmle.label | github.event.issue.title |
+| .github/workflows/association_check_wrong_event.yml:21:21:21:51 | github.event.issue.title | semmle.label | github.event.issue.title |
 | .github/workflows/changed-files.yml:15:9:18:6 | Uses Step: changed-files1 | semmle.label | Uses Step: changed-files1 |
 | .github/workflows/changed-files.yml:20:24:20:76 | steps.changed-files1.outputs.all_changed_files | semmle.label | steps.changed-files1.outputs.all_changed_files |
 | .github/workflows/changed-files.yml:33:9:38:6 | Uses Step: changed-files3 | semmle.label | Uses Step: changed-files3 |
@@ -729,6 +731,7 @@ subpaths
 | .github/workflows/artifactpoisoning6.yml:29:20:29:59 | steps.artifact2.outputs.pr_number | .github/workflows/artifactpoisoning6.yml:8:9:15:6 | Uses Step | .github/workflows/artifactpoisoning6.yml:29:20:29:59 | steps.artifact2.outputs.pr_number | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning6.yml:29:20:29:59 | steps.artifact2.outputs.pr_number | ${{ steps.artifact2.outputs.pr_number }} | .github/workflows/artifactpoisoning6.yml:3:5:3:16 | workflow_run | workflow_run |
 | .github/workflows/artifactpoisoning7.yml:30:20:30:58 | steps.artifact.outputs.pr_number | .github/workflows/artifactpoisoning7.yml:8:9:15:6 | Uses Step | .github/workflows/artifactpoisoning7.yml:30:20:30:58 | steps.artifact.outputs.pr_number | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning7.yml:30:20:30:58 | steps.artifact.outputs.pr_number | ${{ steps.artifact.outputs.pr_number }} | .github/workflows/artifactpoisoning7.yml:3:5:3:16 | workflow_run | workflow_run |
 | .github/workflows/artifactpoisoning8.yml:22:20:22:51 | steps.artifact.outputs.id | .github/workflows/artifactpoisoning8.yml:9:9:17:6 | Uses Step | .github/workflows/artifactpoisoning8.yml:22:20:22:51 | steps.artifact.outputs.id | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning8.yml:22:20:22:51 | steps.artifact.outputs.id | ${{ steps.artifact.outputs.id }} | .github/workflows/artifactpoisoning8.yml:4:5:4:16 | workflow_run | workflow_run |
+| .github/workflows/association_check_wrong_event.yml:13:21:13:51 | github.event.issue.title | .github/workflows/association_check_wrong_event.yml:13:21:13:51 | github.event.issue.title | .github/workflows/association_check_wrong_event.yml:13:21:13:51 | github.event.issue.title | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/association_check_wrong_event.yml:13:21:13:51 | github.event.issue.title | ${{ github.event.issue.title }} | .github/workflows/association_check_wrong_event.yml:2:3:2:8 | issues | issues |
 | .github/workflows/comment_issue.yml:9:15:9:46 | github.event.comment.body | .github/workflows/comment_issue.yml:9:15:9:46 | github.event.comment.body | .github/workflows/comment_issue.yml:9:15:9:46 | github.event.comment.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/comment_issue.yml:9:15:9:46 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/comment_issue.yml:1:5:1:17 | issue_comment | issue_comment |
 | .github/workflows/comment_issue.yml:15:19:15:50 | github.event.comment.body | .github/workflows/comment_issue.yml:15:19:15:50 | github.event.comment.body | .github/workflows/comment_issue.yml:15:19:15:50 | github.event.comment.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/comment_issue.yml:15:19:15:50 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/comment_issue.yml:1:5:1:17 | issue_comment | issue_comment |
 | .github/workflows/comment_issue.yml:16:19:16:48 | github.event.issue.body | .github/workflows/comment_issue.yml:16:19:16:48 | github.event.issue.body | .github/workflows/comment_issue.yml:16:19:16:48 | github.event.issue.body | Potential code injection in $@, which may be controlled by an external user ($@). | .github/workflows/comment_issue.yml:16:19:16:48 | github.event.issue.body | ${{ github.event.issue.body }} | .github/workflows/comment_issue.yml:1:5:1:17 | issue_comment | issue_comment |
diff --git a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected
index f10a7a55c049..8ed3ce95387b 100644
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected
@@ -312,6 +312,8 @@ nodes
 | .github/workflows/artifactpoisoning8.yml:17:9:21:6 | Run Step: artifact [id] | semmle.label | Run Step: artifact [id] |
 | .github/workflows/artifactpoisoning8.yml:19:14:19:58 | echo "::set-output name=id::$(<artifact.txt)" | semmle.label | echo "::set-output name=id::$(<artifact.txt)" |
 | .github/workflows/artifactpoisoning8.yml:22:20:22:51 | steps.artifact.outputs.id | semmle.label | steps.artifact.outputs.id |
+| .github/workflows/association_check_wrong_event.yml:13:21:13:51 | github.event.issue.title | semmle.label | github.event.issue.title |
+| .github/workflows/association_check_wrong_event.yml:21:21:21:51 | github.event.issue.title | semmle.label | github.event.issue.title |
 | .github/workflows/changed-files.yml:15:9:18:6 | Uses Step: changed-files1 | semmle.label | Uses Step: changed-files1 |
 | .github/workflows/changed-files.yml:20:24:20:76 | steps.changed-files1.outputs.all_changed_files | semmle.label | steps.changed-files1.outputs.all_changed_files |
 | .github/workflows/changed-files.yml:33:9:38:6 | Uses Step: changed-files3 | semmle.label | Uses Step: changed-files3 |
@@ -718,6 +720,7 @@ subpaths
 | .github/workflows/actor_check_valid_event.yml:12:21:12:58 | github.event.pull_request.title | .github/workflows/actor_check_valid_event.yml:12:21:12:58 | github.event.pull_request.title | .github/workflows/actor_check_valid_event.yml:12:21:12:58 | github.event.pull_request.title | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/actor_check_valid_event.yml:12:21:12:58 | github.event.pull_request.title | ${{ github.event.pull_request.title }} |
 | .github/workflows/actor_check_wrong_event.yml:20:21:20:51 | github.event.issue.title | .github/workflows/actor_check_wrong_event.yml:20:21:20:51 | github.event.issue.title | .github/workflows/actor_check_wrong_event.yml:20:21:20:51 | github.event.issue.title | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/actor_check_wrong_event.yml:20:21:20:51 | github.event.issue.title | ${{ github.event.issue.title }} |
 | .github/workflows/actor_check_wrong_event.yml:28:21:28:51 | github.event.issue.title | .github/workflows/actor_check_wrong_event.yml:28:21:28:51 | github.event.issue.title | .github/workflows/actor_check_wrong_event.yml:28:21:28:51 | github.event.issue.title | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/actor_check_wrong_event.yml:28:21:28:51 | github.event.issue.title | ${{ github.event.issue.title }} |
+| .github/workflows/association_check_wrong_event.yml:21:21:21:51 | github.event.issue.title | .github/workflows/association_check_wrong_event.yml:21:21:21:51 | github.event.issue.title | .github/workflows/association_check_wrong_event.yml:21:21:21:51 | github.event.issue.title | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/association_check_wrong_event.yml:21:21:21:51 | github.event.issue.title | ${{ github.event.issue.title }} |
 | .github/workflows/changed-files.yml:20:24:20:76 | steps.changed-files1.outputs.all_changed_files | .github/workflows/changed-files.yml:15:9:18:6 | Uses Step: changed-files1 | .github/workflows/changed-files.yml:20:24:20:76 | steps.changed-files1.outputs.all_changed_files | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/changed-files.yml:20:24:20:76 | steps.changed-files1.outputs.all_changed_files | ${{ steps.changed-files1.outputs.all_changed_files }} |
 | .github/workflows/changed-files.yml:40:24:40:76 | steps.changed-files3.outputs.all_changed_files | .github/workflows/changed-files.yml:33:9:38:6 | Uses Step: changed-files3 | .github/workflows/changed-files.yml:40:24:40:76 | steps.changed-files3.outputs.all_changed_files | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/changed-files.yml:40:24:40:76 | steps.changed-files3.outputs.all_changed_files | ${{ steps.changed-files3.outputs.all_changed_files }} |
 | .github/workflows/changed-files.yml:58:24:58:76 | steps.changed-files5.outputs.all_changed_files | .github/workflows/changed-files.yml:53:9:56:6 | Uses Step: changed-files5 | .github/workflows/changed-files.yml:58:24:58:76 | steps.changed-files5.outputs.all_changed_files | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/changed-files.yml:58:24:58:76 | steps.changed-files5.outputs.all_changed_files | ${{ steps.changed-files5.outputs.all_changed_files }} |
diff --git a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.expected b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.expected
index 4f0bd967c2b0..78a25f6c212a 100644
--- a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.expected
@@ -104,8 +104,3 @@ edges
 | .github/workflows/test0.yml:58:9:60:2 | Run Step | .github/workflows/test0.yml:54:9:58:6 | Uses Step | .github/workflows/test0.yml:58:9:60:2 | Run Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test0.yml:4:3:4:15 | issue_comment | issue_comment |
 | .github/workflows/test0.yml:68:9:68:43 | Run Step | .github/workflows/test0.yml:64:9:68:6 | Uses Step | .github/workflows/test0.yml:68:9:68:43 | Run Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test0.yml:4:3:4:15 | issue_comment | issue_comment |
 | .github/workflows/test4.yml:85:7:88:54 | Uses Step | .github/workflows/test4.yml:79:7:85:4 | Uses Step | .github/workflows/test4.yml:85:7:88:54 | Uses Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test4.yml:5:3:5:15 | issue_comment | issue_comment |
-| .github/workflows/test5.yml:151:7:156:4 | Uses Step | .github/workflows/test5.yml:87:7:93:4 | Uses Step | .github/workflows/test5.yml:151:7:156:4 | Uses Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test5.yml:5:3:5:15 | issue_comment | issue_comment |
-| .github/workflows/test5.yml:156:7:169:4 | Run Step | .github/workflows/test5.yml:87:7:93:4 | Uses Step | .github/workflows/test5.yml:156:7:169:4 | Run Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test5.yml:5:3:5:15 | issue_comment | issue_comment |
-| .github/workflows/test5.yml:169:7:180:4 | Run Step | .github/workflows/test5.yml:87:7:93:4 | Uses Step | .github/workflows/test5.yml:169:7:180:4 | Run Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test5.yml:5:3:5:15 | issue_comment | issue_comment |
-| .github/workflows/test6.yml:213:7:218:4 | Uses Step | .github/workflows/test6.yml:162:7:167:4 | Uses Step | .github/workflows/test6.yml:213:7:218:4 | Uses Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test6.yml:5:3:5:15 | issue_comment | issue_comment |
-| .github/workflows/test6.yml:218:7:224:4 | Run Step | .github/workflows/test6.yml:162:7:167:4 | Uses Step | .github/workflows/test6.yml:218:7:224:4 | Run Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test6.yml:5:3:5:15 | issue_comment | issue_comment |
diff --git a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.expected b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.expected
index 4f7149b69803..e69de29bb2d1 100644
--- a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.expected
+++ b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.expected
@@ -1,2 +0,0 @@
-| .github/workflows/test6.yml:42:7:47:4 | Uses Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test6.yml:5:3:5:15 | issue_comment | issue_comment |
-| .github/workflows/test6.yml:92:7:97:4 | Uses Step | Insufficient protection against execution of untrusted code on a privileged workflow ($@). | .github/workflows/test6.yml:5:3:5:15 | issue_comment | issue_comment |
diff --git a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected
index 910d5742e572..32999ec70e27 100644
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected
@@ -472,6 +472,11 @@ edges
 | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:22:27:22:58 | github.event.issue.number | .github/workflows/test7.yml:60:9:60:37 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test7.yml:22:27:22:58 | github.event.issue.number | github.event.issue.number | .github/workflows/test7.yml:4:3:4:15 | issue_comment | issue_comment |
 | .github/workflows/test10.yml:20:9:25:6 | Uses Step | .github/workflows/test10.yml:23:17:23:79 | github.event.after \|\| github.event.pull_request.head.sha | .github/workflows/test10.yml:25:9:30:2 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test10.yml:23:17:23:79 | github.event.after \|\| github.event.pull_request.head.sha | github.event.after \|\| github.event.pull_request.head.sha | .github/workflows/test10.yml:8:3:8:21 | pull_request_target | pull_request_target |
 | .github/workflows/test11.yml:84:7:90:4 | Uses Step | .github/workflows/test11.yml:88:15:88:55 | steps.environment.outputs.head_sha | .github/workflows/test11.yml:90:7:93:54 | Uses Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test11.yml:88:15:88:55 | steps.environment.outputs.head_sha | steps.environment.outputs.head_sha | .github/workflows/test11.yml:5:3:5:15 | issue_comment | issue_comment |
+| .github/workflows/test14.yml:105:7:111:4 | Uses Step | .github/workflows/test14.yml:109:15:109:58 | steps.comment-branch.outputs.head_ref | .github/workflows/test14.yml:169:7:174:4 | Uses Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test14.yml:109:15:109:58 | steps.comment-branch.outputs.head_ref | steps.comment-branch.outputs.head_ref | .github/workflows/test14.yml:5:3:5:15 | issue_comment | issue_comment |
+| .github/workflows/test14.yml:105:7:111:4 | Uses Step | .github/workflows/test14.yml:109:15:109:58 | steps.comment-branch.outputs.head_ref | .github/workflows/test14.yml:174:7:187:4 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test14.yml:109:15:109:58 | steps.comment-branch.outputs.head_ref | steps.comment-branch.outputs.head_ref | .github/workflows/test14.yml:5:3:5:15 | issue_comment | issue_comment |
+| .github/workflows/test14.yml:105:7:111:4 | Uses Step | .github/workflows/test14.yml:109:15:109:58 | steps.comment-branch.outputs.head_ref | .github/workflows/test14.yml:187:7:198:4 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test14.yml:109:15:109:58 | steps.comment-branch.outputs.head_ref | steps.comment-branch.outputs.head_ref | .github/workflows/test14.yml:5:3:5:15 | issue_comment | issue_comment |
+| .github/workflows/test15.yml:180:7:185:4 | Uses Step | .github/workflows/test15.yml:183:15:183:58 | steps.comment-branch.outputs.head_ref | .github/workflows/test15.yml:231:7:236:4 | Uses Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test15.yml:183:15:183:58 | steps.comment-branch.outputs.head_ref | steps.comment-branch.outputs.head_ref | .github/workflows/test15.yml:5:3:5:15 | issue_comment | issue_comment |
+| .github/workflows/test15.yml:180:7:185:4 | Uses Step | .github/workflows/test15.yml:183:15:183:58 | steps.comment-branch.outputs.head_ref | .github/workflows/test15.yml:236:7:242:4 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test15.yml:183:15:183:58 | steps.comment-branch.outputs.head_ref | steps.comment-branch.outputs.head_ref | .github/workflows/test15.yml:5:3:5:15 | issue_comment | issue_comment |
 | .github/workflows/test17.yml:12:15:19:12 | Uses Step | .github/workflows/test17.yml:16:25:16:68 | github.event.workflow_run.head_branch | .github/workflows/test17.yml:19:15:23:58 | Uses Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test17.yml:16:25:16:68 | github.event.workflow_run.head_branch | github.event.workflow_run.head_branch | .github/workflows/test17.yml:3:5:3:16 | workflow_run | workflow_run |
 | .github/workflows/test27.yml:18:9:21:6 | Uses Step | .github/workflows/test27.yml:20:17:20:37 | inputs.git_ref | .github/workflows/test27.yml:21:9:22:16 | Run Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test27.yml:20:17:20:37 | inputs.git_ref | inputs.git_ref | .github/workflows/test26.yml:4:3:4:14 | workflow_run | workflow_run |
 | .github/workflows/test29.yml:8:7:14:4 | Uses Step | .github/workflows/test29.yml:11:15:11:55 | github.event.pull_request.head.sha | .github/workflows/test29.yml:14:7:21:11 | Uses Step | Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test29.yml:11:15:11:55 | github.event.pull_request.head.sha | github.event.pull_request.head.sha | .github/workflows/test29.yml:1:5:1:23 | pull_request_target | pull_request_target |