Split payload-field actor checks into EventActorIfCheck

Per review, ActorIfCheck now only covers github.actor and
github.triggering_actor, which are populated for every event and need
no event-validity override. Checks on actor fields read from the event
payload move to the new EventActorIfCheck class, which only protects
events whose payload populates the checked field.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4084febb-f9c7-44df-baf3-c8be8e9932a7

Author: computersarebad

actions/ql/lib/change-notes/2026-08-17-actor-if-check-event-validity.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* Altered the logic of `ActorIfCheck` so that checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change will result in more results being found by the queries that rely on control checks, such as `actions/code-injection/critical`.
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) now only count as protection for events whose payload actually populates that field. These checks were split out of `ActorIfCheck` into a new class `EventActorIfCheck`, and `ActorIfCheck` now only covers `github.actor` and `github.triggering_actor`. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change will result in more results being found by the queries that rely on control checks, such as `actions/code-injection/critical`.

actions/ql/lib/codeql/actions/security/ControlChecks.qll

@@ -329,13 +329,6 @@ private string eventPayloadActorFieldRegex(string context_prefix) {
 
 class ActorIfCheck extends ActorCheck instanceof If {
   ActorIfCheck() {
-    // eg: github.event.pull_request.user.login == 'admin'
-    exists(
-      normalizeExpr(this.getCondition())
-          .regexpFind([eventPayloadActorFieldRegex(_), "\\bgithub\\.event\\.sender\\.login\\b"], _,
-            _)
-    )
-    or
     // eg: github.actor == 'admin'
     // eg: github.triggering_actor == 'admin'
     exists(
@@ -344,28 +337,38 @@ class ActorIfCheck extends ActorCheck instanceof If {
     ) and
     not normalizeExpr(this.getCondition()).matches("%[bot]%")
   }
+}
+
+/** An If node that checks an actor field from the event payload */
+class EventActorIfCheck extends ActorCheck instanceof If {
+  EventActorIfCheck() {
+    // eg: github.event.pull_request.user.login == 'admin'
+    exists(
+      normalizeExpr(this.getCondition())
+          .regexpFind([eventPayloadActorFieldRegex(_), "\\bgithub\\.event\\.sender\\.login\\b"], _,
+            _)
+    )
+  }
 
   override predicate protectsCategoryAndEvent(string category, string event) {
     ActorCheck.super.protectsCategoryAndEvent(category, event) and
     (
-      // `github.actor`, `github.triggering_actor` and `github.event.sender.login`
-      // are populated for every event
+      // the `sender` object is part of every webhook event payload,
+      // so `github.event.sender.login` is populated for every event
       exists(
         normalizeExpr(this.(If).getCondition())
             .regexpFind("\\bgithub\\.event\\.sender\\.login\\b", _, _)
       )
       or
-      exists(
-        normalizeExpr(this.(If).getCondition())
-            .regexpFind(["\\bgithub\\.actor\\b", "\\bgithub\\.triggering_actor\\b",], _, _)
-      ) and
-      not normalizeExpr(this.(If).getCondition()).matches("%[bot]%")
-      or
-      // actor fields read from the event payload are only populated for events
-      // whose payload contains the corresponding context. eg: a check on
+      // other actor fields are only populated for events whose payload contains
+      // the corresponding context. eg: a check on
       // `github.event.pull_request.user.login` cannot restrict the actor of an
       // `issues` event since `github.event.pull_request` is not populated there,
-      // which makes the condition vacuous
+      // which makes the condition vacuous.
+      // note that `github.event.head_commit` and `github.event.commits` are only
+      // populated for `push` events, which are not protectable by ActorCheck, so
+      // checks on those fields never count as protection here. they are still
+      // matched so that these Ifs keep being classified as actor checks
       exists(string context_prefix |
         contextTriggerDataModel(event, context_prefix) and
         exists(