feat(sources): New sources

This PR also adds the ability to not limit a source to a trigger event

Author: Alvaro Muñoz

ql/lib/ext/trilom_file-changes-action.model.yml

@@ -0,0 +1,11 @@
+extensions:
+  - addsTo:
+      pack: githubsecuritylab/actions-all
+      extensible: sourceModel
+    data:
+      # https://github.com/trilom/file-changes-action
+      # if `prNumber` is provided, the trigger event dont need to be `pull_request_target`
+      - ["trilom/file-changes-action", "*", "output.files", "*", "PR changed files"]
+      - ["trilom/file-changes-action", "*", "output.files_added", "*", "PR changed files"]
+      - ["trilom/file-changes-action", "*", "output.files_modified", "*", "PR changed files"]
+      - ["trilom/file-changes-action", "*", "output.files_removed", "*", "PR changed files"]

ql/src/Security/CWE-094/PrivilegedCodeInjection.ql

@@ -24,6 +24,7 @@ where
   w = source.getNode().asExpr().getEnclosingWorkflow() and
   (
     w instanceof ReusableWorkflow or
+    source.getNode().(RemoteFlowSource).getATriggerEvent() = "*" or
     w.hasTriggerEvent(source.getNode().(RemoteFlowSource).getATriggerEvent())
   )
 select sink.getNode(), source, sink,