Apply suggestions from code review

Co-authored-by: Aditya Sharad <[email protected]>

Author: martincostello

actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

@@ -40,7 +40,7 @@ where
   ) and
   uses.getVersion() = version and
   not isTrustedOwner(nwo) and
-  not if isContainerImage(nwo) then isPinnedContainer(version) else isPinnedCommit(version) and
+  not (if isContainerImage(nwo) then isPinnedContainer(version) else isPinnedCommit(version)) and
   not isImmutableAction(uses, nwo)
 select uses.getCalleeNode(),
   "Unpinned 3rd party Action '" + name + "' step $@ uses '" + nwo + "' with ref '" + version +

actions/ql/src/change-notes/2025-02-14-docker-false-positives.md

@@ -2,4 +2,4 @@
 category: minorAnalysis
 ---
 
-* Fix CWE-829 false positives for Docker GitHub actions pinned by the container's SHA256 digest.
+* Fixed false positives in the query `actions/unpinned-tag` (CWE-829), which will no longer flag uses of Docker-based GitHub actions pinned by the container's SHA256 digest.