actions: rename self-reference to self repository in unpinned-tag

Canonical terminology flip: `$/` resolves to the same REPOSITORY at the
running SHA ("self repository"), while `./` is "self workspace". Rename the
isSelfReference predicate to isSelfRepository, reword the code comment, and
update the change note (renamed to ...-self-repository.md) and test fixture
comments to match. No change to query results, the finding message, or any
.expected output.

Author: nodeselector

actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

@@ -33,11 +33,11 @@ private predicate isPinnedContainer(string version) {
 bindingset[nwo]
 private predicate isContainerImage(string nwo) { nwo.regexpMatch("^docker://.+") }
 
-// A `$/` reference is a same-repo self-reference (e.g. `$/path/to/action`), resolved at the
-// commit the calling workflow is running. Like `./` local references, it is inherently pinned
-// and can never be an unpinned-tag finding, so we never flag it.
+// A `$/` reference is a same-repository (self repository) reference (e.g. `$/path/to/action`),
+// resolved at the commit the calling workflow is running. Like `./` local (self workspace)
+// references, it is inherently pinned and can never be an unpinned-tag finding, so we never flag it.
 bindingset[nwo]
-private predicate isSelfReference(string nwo) { nwo.matches("$/%") }
+private predicate isSelfRepository(string nwo) { nwo.matches("$/%") }
 
 // Holds if `uses` (calling action `nwo` at `version`) is pinned by an entry in the repository's
 // Actions lockfile (`.github/workflows/actions.lock`). The underlying `pinnedByLockfileDataModel`
@@ -70,7 +70,7 @@ where
   getStepContainerName(uses, name) and
   uses.getVersion() = version and
   not isTrustedOwner(nwo) and
-  not isSelfReference(nwo) and
+  not isSelfRepository(nwo) and
   not pinnedByLockfile(uses, nwo, version) and
   not (if isContainerImage(nwo) then isPinnedContainer(version) else isPinnedCommit(version)) and
   not isImmutableAction(uses, nwo)

actions/ql/src/change-notes/2026-07-09-unpinned-tag-self-reference.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `actions/unpinned-tag` query no longer reports `$/` self repository references (e.g. `uses: $/path/to/action`), which resolve to the same repository at the running commit and are therefore inherently pinned, just like `./` self workspace (local) references.

actions/ql/src/change-notes/2026-07-09-unpinned-tag-self-repository.md

@@ -6,10 +6,10 @@ jobs:
     name: Build and test
     runs-on: ubuntu-latest
     steps:
-    # `$/` is a same-repo self-reference resolved at the running commit. It is inherently
-    # pinned (like `./` local refs) and must never be reported as an unpinned tag.
+    # `$/` is a same-repository (self repository) reference resolved at the running commit. It is
+    # inherently pinned (like `./` self workspace refs) and must never be reported as an unpinned tag.
     - uses: $/actions/foo
     # `$/…@ref` is rejected by the `$/` rule, but a user could still write it. It must also
-    # never be flagged; this case exercises the `not isSelfReference(nwo)` suppression, since
+    # never be flagged; this case exercises the `not isSelfRepository(nwo)` suppression, since
     # without it `$/actions/foo@v1` would otherwise be reported as an unpinned tag.
     - uses: $/actions/foo@v1