diff --git a/actions/ql/lib/codeql/actions/security/ControlChecks.qll b/actions/ql/lib/codeql/actions/security/ControlChecks.qll index 5a57e59c317..0181aab8a64 100644 --- a/actions/ql/lib/codeql/actions/security/ControlChecks.qll +++ b/actions/ql/lib/codeql/actions/security/ControlChecks.qll @@ -105,7 +105,7 @@ abstract class ControlCheck extends AstNode { or // When the node is inside a (possibly nested) reusable workflow, // all direct callers for this event must be protected along their caller chain. - exists(ExternalJob directCaller | + exists(ExternalJob directCaller | directCaller = node.getEnclosingWorkflow().(ReusableWorkflow).getACaller() and directCaller.getATriggerEvent() = event ) and