Actions: fix filtering of code injection results between medium and critical version of query

[owen-mc]

Fixes https://github.com/github/codeql-team/issues/4370 . Includes a test demonstrating this.

In general I think the filtering between different severity levels for many queries should probably be modified to be more like this, so that it's clearer that we aren't letting some alerts fall between the cracks.

[Copilot]

Pull request overview

This PR fixes a filtering gap in code injection queries where alerts could be missed when neither the medium nor critical severity query would report them.

• Introduces a new helper predicate getRelevantCriticalEventForSourceSink that checks both sink context and source event matching
• Updates the medium query to explicitly exclude critical query results rather than using complementary context checks
• Adds test case demonstrating the fix with a workflow triggered by both push and workflow_dispatch events

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll	Adds new predicate combining sink context and source event checks
actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql	Simplifies query to use new combined predicate
actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql	Changes to explicitly exclude critical results using new predicate
actions/ql/test/query-tests/Security/CWE-094/.github/workflows/push_and_workflow_dispatch.yml	New test case demonstrating the filtering fix
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected	Updated expected test results
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected	Updated expected test results
actions/ql/lib/change-notes/2025-11-28-fix-code-injection-alert-filtering.md	Documents the majorAnalysis change

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.